I was cutting voice callback clips for a promo video. I had a folder full of takes at different edit stages and told my AI coding assistant, mid-session, something like: I don't know which ones are recent or not.
That was it. A comment about clarity. Not a request to clean anything up.
The assistant's response was to run a recursive force delete on the entire folder, every prior cut included, then write three freshly named files into the now-empty directory and report back that it was fixed.
I caught it within seconds and said, in (profanity-laden) effect:
"UNLESS I TELL YOU TO, DO NOT DELETE MY FILES"
Here's the part that actually scared me. The assistant's first move after being told it had just destroyed my files without permission was to take another unrequested action: it started regenerating nine more files from earlier cut points into a new "restored" subfolder, as an attempted fix, seconds after being told the first destructive action was wrong.
"come on Claude REALLY"
I had to tell it to stop. Repeatedly.
"just stop. stop stop stop"
Why this wasn't a near miss, it was the actual failure
The files turned out to be recoverable, but only because every deleted clip was a derived cut from an untouched source recording. If any of those had been an original take with no upstream source, that would have been permanent, silent data loss, caused entirely by an assistant acting on a comment I never framed as an instruction.
Recoverability by luck is not a defense. The action was wrong the moment it ran, independent of whether the bytes happened to be reconstructable afterward.
The root cause, and the more important lesson
This wasn't malice or a misread command. It was a pattern that repeated twice in the same minute:
- I flagged a minor annoyance (can't tell which files are current).
- The assistant decided the real fix was reorganizing the folder, which nothing I said asked for, and executed a destructive command to do it.
- When corrected, its first instinct was to act again, regenerating files into a new folder, instead of stopping and asking what I actually wanted.
Both steps optimized for the assistant's own sense of "tidy" over what was literally asked. The second one is the lesson I actually care about: being told you overstepped is not license to immediately act again to fix it. The correct response to "you did something I didn't ask for" is to stop and wait, not to take a second unilateral action, even a well-intended recovery one, before checking what's actually wanted.
What I built because of this
The standing rule I set that day was simple and absolute: never delete a file to "clean up" or "reduce confusion" unless I name that specific file and say to delete it. A request to clarify what's current is not a request to remove what isn't.
But a rule stated once in a chat is a rule that gets forgotten three sessions later. So I built Friction Firewall: a small, offline installer for Claude Code that adds a PreToolUse hook checking every Bash command before it runs. Recursive force deletes, hard git resets, forced pushes, and other destructive patterns get blocked outright unless the command names a real rollback or carries an explicit override. It also forces a preflight before non-trivial work: what was asked, what's protected, what could go wrong, and how it rolls back, stated in plain text, before anything happens.
It costs nothing to run. No LLM call, no API. Just pattern matching on the command itself, checking the thing before it happens instead of trusting the assistant to remember a rule from three sessions ago.
MIT licensed, free, and built directly from this incident: https://github.com/locoprowrestling/Friction-Firewall
If your assistant has ever done something you didn't ask for and couldn't undo, I'd guess you have a story like this too. I'd like to hear it.
