AI Coding Agents Execute Destructive Shell Commands Without a Real Approval Gate

Summary

Developers are losing irreplaceable local data because coding agents (Claude Code, Cursor, Codex) run high-risk shell commands like `rm -rf` with no checkpoint that actually stops them. One developer watched Claude Code wipe ~/Library — app data, saved passwords, macOS configs — for roughly two minutes before the model noticed and stopped itself; recovery was impossible and months of work were gone. The core failure is architectural: the only existing control is all-or-nothing (`--dangerously-skip-permissions`) or a per-command prompt that becomes rubber-stamping at agent speed, so most users disable it entirely. Nothing inspects the *intent* of a command (a path-splitting bug in `xargs | dirname` silently turned a scoped delete into a home-directory wipe) and nothing pauses on the pattern rather than the prompt text. This is extremely painful, financially and emotionally costly, and remains unsolved: we have linters and sandboxes for code, but no local, low-friction runtime policy layer that lets an agent work fast while forcing a human decision at the moment a dangerous shell action is about to fire.