Is Claude Code Safe? Preventing 'rm -rf' in Agentic Workflows

The rapid rise of terminal based AI agents has forced a critical question into the spotlight: Is Claude Code safe? When you give a large language model the ability to execute bash commands directly on your machine, you are effectively handing over the keys to your filesystem. While the productivity gains of agentic workflows are undeniable, the risk of a misinterpreted prompt leading to a catastrophic rm -rf / or an accidental sensitive data leak is a reality every developer must address. This guide explores the security architecture of Claude Code, the inherent risks of autonomous shell access, and how to build a layered defense strategy to keep your development environment secure.

Understanding the Agentic Execution Model

Agentic tools like Claude Code differ from traditional chat interfaces because they operate in a loop of observation, thought, and action. Instead of just suggesting code, they interact with the shell, read files, and run build commands. This level of agency requires a high degree of trust.

The primary risk stems from the non-deterministic nature of AI. A model might hallucinate a path or misunderstand the scope of a cleanup command. If the agent is tasked with deleting temporary files but fails to correctly parse a variable, it could target a directory containing your entire project history. Security in this context is not just about preventing malicious intent, but also about mitigating accidental destruction.

Common Bash Execution Risks in AI Workflows

When using Claude Code or similar tools like Codex CLI, developers face three main categories of risk. Each of these requires a specific approach to mitigation.

1. Unintended File Deletion: This is the classic rm -rf scenario. It often happens when the agent tries to clear a cache or remove a build artifact but uses an overly broad wildcard or an undefined environment variable.
2. Data Exfiltration: If an agent has access to your environment variables, it could accidentally read a .env file containing production secrets and include that data in its reasoning logs or send it back to the model provider.
3. Supply Chain Vulnerabilities: An agent might be asked to install a dependency. If it chooses a typo-squatted package or a compromised library, it could introduce a backdoor into your local system.

Implementing Manual Approvals and Guardrails

The most effective way to ensure safety is to maintain a human in the loop. Most agentic tools offer different levels of autonomy.

Restricted vs. Full Autonomy

You can typically configure whether an agent asks for permission before every command or only for those deemed high risk. For beginners, it is highly recommended to stay in a manual approval mode. This allows you to verify every string of bash code before it hits your terminal.

Using Deska for Side by Side Monitoring

One practical way to manage these risks is by using a workspace that gives you a high level view of all activity. Deska provides an infinite canvas where you can run coding agents like Claude Code in one panel while keeping your terminal and file explorer visible in others. Because Deska is local-first, the execution happens on your machine, but the canvas allows you to zoom out and see exactly what the agent is doing across multiple sessions.

You can set up your workspace to have a dedicated terminal for the agent and another for your own manual checks. This visibility is crucial for catching an agent before it performs an irreversible action.

Environment Isolation and Containerization

To truly minimize the blast radius of a rogue command, you should consider isolating the environment where the agent operates.

• Docker Containers: Running your agent inside a container limits its access to only the files mapped into that container. It cannot touch your home directory or system configurations.
• Virtual Machines: For even higher isolation, a dedicated VM ensures that the agent is completely separated from your host OS.
• Restricted User Accounts: Creating a specific shell user with limited permissions for the AI agent can prevent it from executing sudo commands or accessing sensitive directories.

The Role of Local First Security

A major concern with cloud based AI tools is where your data goes. Claude Code interacts with your local files, which means the model provider receives context from your codebase to provide answers.

Deska addresses this by being a local-first application. While the AI inference might happen on remote servers depending on your configuration, your files, session history, and workspace layout stay on your machine. For developers who prefer maximum control, Deska supports a BYOK (Bring Your Own Key) model. This ensures you have a direct relationship with the API provider and full visibility into what is being sent.

Best Practices for Secure Agentic Workflows

To stay safe while using Claude Code, follow these operational standards:

• Never run agents as a root or administrative user.
• Always review git diff after an agent completes a task to ensure no hidden changes were made to configuration files.
• Use a dedicated workspace like the Deska canvas to separate agent experiments from your main production environment.
• Limit the scope of the agent to specific subdirectories whenever possible.
• Regularly audit the terminal panels to see the history of commands executed by the AI.

Comparing Agent Architectures

Different tools handle security and execution in various ways. While Claude Code focuses on a tight terminal integration, others like OpenCode or Codex CLI might have different defaults for command confirmation.

Deska acts as a wrapper that enhances the safety of these tools by providing better visibility and control. Through Ask Deska, you can use voice or chat to manage your panels and monitor sessions, making it easier to kill a process if you see something suspicious.

FAQ

How do I stop Claude Code from deleting files?

The best way to prevent file deletion is to keep the tool in its default mode where it asks for confirmation before executing rm or other destructive bash commands. Additionally, ensure you are working within a git repository so you can revert any accidental changes.

Is my code sent to third party servers?

Yes, when using Claude Code, relevant snippets of your code are sent to Anthropic to process your requests. To minimize exposure, you can use .claudeignore files to prevent the agent from reading sensitive data, and use local-first tools like Deska to keep your workspace metadata private.

Can I run Claude Code on Windows or Linux?

Claude Code is designed to work across major operating systems. If you want a unified experience, you can download Deska for Mac, Windows, and Linux. It allows you to run Claude Code as a panel alongside other tools in a single infinite workspace.

Getting Started with Secure AI Automation

Integrating AI agents into your workflow does not have to be a gamble. By combining the power of Claude Code with a secure, visible environment like Deska, you can enjoy the benefits of automation without sacrificing the integrity of your system. The key is to start with high restrictions and slowly increase autonomy as you become familiar with the agent's behavior.

Ready to build a more secure agentic workspace? Download Deska and start running your coding agents side by side with full visibility. Using the mobile app, you can even monitor long running agent tasks from your phone through a secure relay, ensuring you are always in control of your terminal.