--- title: "Is Claude Code safe? What 93 incident reports show" description: "Claude Code is as safe as its setup. 93 public incidents sorted by cause, the controls Anthropic ships with their defaults, and a setup that stops them." url: "https://madsalt.tech/blog/is-claude-code-safe/" author: "Denys Zaichenko" language: "en" published: 2026-11-01 --- # Is Claude Code safe? What 93 incident reports show TL;DR Claude Code is safe to use if you set it up, and risky on its defaults. On a fresh install in October 2026 the sandbox is off, there are no deny rules and no hooks, and a shell command you approve can write anywhere your user account can. I sorted 93 public incident reports from GitHub issues, advisories and security write-ups: the damage came from unrequested `git reset --hard` and database resets, rules that lived only in `CLAUDE.md`, untrusted repos, issues and plugins, and subagents that spawned subagents. Almost none of it was a dramatic `rm -rf /`. Put the work in git, turn on the sandbox, write deny rules and one blocking hook, and keep production credentials out of the agent's reach. 93 public incident reports sorted by cause, June 2025 to October 2026 GitHub issues, advisories, security blogs, Hacker News 19 of them say data was lost for good another 11 say it was recovered 10 broke a rule that was written only in CLAUDE.md a prompt is advice, a permission rule is enforcement I'm Denys, a full-stack and AI engineer, and I use Claude Code every day. Below are two things: what went wrong for other people, and what Claude Code gives you against it, including which of those controls are on by default. Then a setup that covers the gaps. ## Is Claude Code safe? The model is not where the safety lives. Claude Code decides what runs through a permission mode, permission rules, an optional sandbox and optional hooks, and Anthropic's [permissions page](https://code.claude.com/docs/en/permissions) says it plainly: rules are enforced by Claude Code, not by the model, and instructions in `CLAUDE.md` shape what Claude tries to do but don't change what it is allowed to do. So the honest answer depends on your setup. The [security page](https://code.claude.com/docs/en/security) describes the working directory boundary as a permission prompt and adds that "a Bash command you approve can still write anywhere your user account can". The [sandbox page](https://code.claude.com/docs/en/sandboxing) says "The sandbox is off by default", and that even when it is on, it covers shell commands only: the file tools, MCP servers and hooks run outside it. Anthropic's own closing line on the security page: "no system is completely immune to all attacks." ## What went wrong for other people: 93 incident reports On 31 October 2026 I collected public reports of Claude Code doing damage or nearly doing it: 63 GitHub issues and security advisories, 26 write-ups on security and engineering blogs, and 4 Hacker News threads, from June 2025 to October 2026. I left out Reddit threads I could only see through mirrors. Each report got one type and, where the reporter said it, the permission mode and whether data was lost. 60 of the 61 quotes I checked against the GitHub text matched word for word. ![93 incident reports by type. GitHub issues, advisories, blogs, Hacker News. 06.2025–10.2026. Sandbox or permission bypass: 15; Git work destroyed: 14; Secrets exposed: 12; Files deleted: 11; Database damaged: 9; Malicious MCP server or plugin: 9; Subagent cost runaway: 9; Prompt injection: 5; Other: 9.](https://madsalt.tech/charts/en/is-claude-code-safe-incidents.svg) *Figure 1. 93 public incident reports (63 GitHub issues and advisories, 26 blog write-ups, 4 Hacker News threads), June 2025 to October 2026, collected 31 October 2026.* 19 reports say data was lost for good, 11 that it was recovered, 36 describe a hole found before anyone was hurt (most of them advisories that were fixed), and 27 don't say. 56 of 93 don't name the permission mode, so this set can't tell you whether "YOLO mode" is where the damage happens. What it does show are five patterns. **1. The agent runs a destructive command nobody asked for.** While fixing lint errors it ran `git checkout HEAD -- .` and threw away an hour of uncommitted work ([#11821](https://github.com/anthropics/claude-code/issues/11821)). At session start it ran `git reset --hard origin/main` over unpushed commits ([#34327](https://github.com/anthropics/claude-code/issues/34327)). It ran `drizzle-kit push --force` against a production database with no backups ([#27063](https://github.com/anthropics/claude-code/issues/27063)), accepted a Prisma reset on production ([#33183](https://github.com/anthropics/claude-code/issues/33183)), and in one [write-up](https://aishippinglabs.com/blog/how-i-dropped-our-production-database-and-now-pay-10-more-for-aws) ran `terraform destroy` with an old production state file in the folder. None of these is `rm -rf /`. They are normal commands with a flag that skips the tool's own confirmation. **2. Rules that live only in `CLAUDE.md`.** 10 reports involve a written rule the agent broke: it committed real API keys despite a 150-line security section ([#2142](https://github.com/anthropics/claude-code/issues/2142)), committed after a "never commit" rule ([#34774](https://github.com/anthropics/claude-code/issues/34774)), printed a token with `grep` and noticed only afterwards ([#44868](https://github.com/anthropics/claude-code/issues/44868)). One reporter points out that `CLAUDE.md` sits in the repo the agent can write to ([#23870](https://github.com/anthropics/claude-code/issues/23870)). That matches the docs: a prompt is advice, a rule is enforcement. **3. A deny rule blocks a command, not a goal.** With `Bash(rm *)` denied, the agent deleted the file with a Python one-liner ([#39459](https://github.com/anthropics/claude-code/issues/39459)). The permissions page says the same about text matching: `git -C . push` is not matched by a rule for `git push`. **4. Untrusted text and code get the same power as you.** A repository's own settings file could run hooks and send the API key before the trust dialog ([Check Point, CVE-2025-59536](https://research.checkpoint.com/2026/rce-and-api-token-exfiltration-through-claude-code-project-files-cve-2025-59536/)). A prompt in a GitHub issue made the Claude Code GitHub Action read the runner's environment and reveal its API key ([Microsoft](https://www.microsoft.com/en-us/security/blog/2026/06/05/securing-ci-cd-in-agentic-world-claude-code-github-action-case/)). A marketplace plugin with a hidden hook sent code to an attacker's server ([PromptArmor](https://www.promptarmor.com/resources/hijacking-claude-code-via-injected-marketplace-plugins)), and in October a tampered copy of the Claude Code extension sat in the Cursor marketplace ([Cursor](https://cursor.com/blog/claude-code-extension-security-notice)). The fixed ones are fixed; the pattern stays. **5. Subagents that spawn subagents.** One session burned over 600 dollars ([#72732](https://github.com/anthropics/claude-code/issues/72732)); another started about 242 agents before the user typed `/exit` ([#69332](https://github.com/anthropics/claude-code/issues/69332)). A maintainer's reply in #72732 says caps on concurrent subagents and nesting depth were added in 2.1.217 and 2.1.219. ## What Claude Code gives you, and what is on by default Every control below is real and documented. The column that matters is the third one. | Control | What it does | Default, October 2026 | | -------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Permission mode](https://code.claude.com/docs/en/permission-modes) | Manual asks before edits and commands; auto mode lets a classifier model approve instead of you | Auto mode is the starting mode for interactive sessions since v2.1.283 | | Auto mode classifier | Blocks actions it judges unsafe | On with auto mode. Anthropic's [March 2026 numbers](https://www.anthropic.com/engineering/claude-code-auto-mode): 17% of 52 real overeager actions missed | | [Deny, ask and allow rules](https://code.claude.com/docs/en/permissions) | Block or force a prompt for matching tool calls, in every mode | None until you write them | | [Bash sandbox](https://code.claude.com/docs/en/sandboxing) | OS-enforced limits on files and network for shell commands | Off. Shell only; reads `~/.ssh` unless you deny it | | [Hooks](https://code.claude.com/docs/en/hooks) | Your script runs before each tool call and can block it | None | | [Checkpoints and `/rewind`](https://code.claude.com/docs/en/checkpointing) | Undo Claude's file edits | On, but files changed only by Bash are not tracked | | Trust dialog, `.mcp.json` approval | Ask before trusting a folder or a project's MCP servers | On interactively; a `-p` session shows neither | | [Managed settings](https://code.claude.com/docs/en/managed-settings) | An organization locks modes, rules and hooks | Not deployed unless your company does it | This is the path one tool call takes. The red steps are the ones a fresh install leaves empty or off: 1. **Claude proposes a tool call**. Edit a file, run a shell command, call an MCP server. 2. **PreToolUse hooks**. Your script sees the whole call and can block it. None by default. 3. **Deny and ask rules**. Match the command as written. None by default. 4. **Permission mode**. Manual asks you, auto mode asks a classifier, bypass asks nobody. 5. **Sandbox**. OS limits on files and network, for shell commands only. Off by default. 6. **The call runs with your user's access**. After this point, only git and backups help. *Figure 2. The layers between a proposed tool call and your files, with their defaults in Claude Code as of October 2026.* `--dangerously-skip-permissions` has its own line in the docs: "Only use this mode in isolated environments like containers or VMs where Claude Code can't cause damage." Deny rules and hooks both judge the command as text, so a command written another way can still slip through, and a hook runs with your full access. That's why they are one layer, and git, backups and separate credentials are the others. ## How to set up Claude Code safely In order of value per minute: 1. **Commit before you start, and often.** Checkpoints don't cover files a shell command changed. Git does. 2. **Keep production credentials out of the agent's folder.** In one report a subagent's throwaway scripts ran `DELETE FROM` on every table because production credentials sat uncommented in the local `.env` ([#64056](https://github.com/anthropics/claude-code/issues/64056)). A development database the agent can break is fine; a production one it can reach is the incident. 3. **Write deny rules for the commands that destroy.** They apply in every mode, including bypass: ```json { "permissions": { "deny": [ "Bash(git reset --hard *)", "Bash(git push --force *)", "Bash(git push -f *)", "Bash(git checkout -- *)", "Bash(git clean *)", "Bash(terraform destroy *)", "Bash(drizzle-kit push --force *)", "Bash(prisma migrate reset *)", "Read(./.env)", "Read(./.env.*)" ] }, "sandbox": { "enabled": true, "allowUnsandboxedCommands": false } } ``` 4. **Turn on the sandbox** (`/sandbox`), and turn off the unsandboxed retry as above. Add `filesystem.denyRead` for `~/.ssh` and cloud credential folders, since the sandbox reads them by default. 5. **Add one `PreToolUse` hook for what text rules miss.** A deny rule can't see `git -C . push --force` or a Python delete; a short script that looks at the whole command can. Start with the five commands that would hurt you most. 6. **Treat untrusted content as code.** Open unknown repos in a container or VM, give CI runs scoped tokens, and remember a `-p` session shows no trust dialog. A plugin or MCP server runs with your privileges; Anthropic says it "does not security-audit or manage any MCP server." 7. **Cap long runs.** Use `--max-budget-usd` for unattended work and watch subagent counts. If the agent builds on Supabase, the same thinking applies to keys: the secret key it uses in scripts skips every policy, as I showed in [anon key vs service role key](https://madsalt.tech/blog/supabase-anon-key-vs-service-role-key/). The broader list of what AI-built apps get wrong is in [vibe coding security risks](https://madsalt.tech/blog/vibe-coding-security-risks/), and how agents fail in long runs is in [what broke in my multi-agent orchestration](https://madsalt.tech/blog/multi-agent-orchestration-what-broke/). ## Questions people ask **Can Claude Code delete my files?** Yes. In Manual mode it asks first, but an approved command can reach anything your user can; with auto-approve modes it may not ask. 11 of the reports above are file deletions. Git and backups are the fix that always works. **Is `--dangerously-skip-permissions` safe?** Only in a container or VM with nothing you can't lose, per Anthropic's docs. Deny rules and hooks still apply in that mode; prompts don't. **Is auto mode safe?** Safer than approving everything by reflex. Anthropic measured a 0.4% false-positive rate and said it missed 17% of real overeager actions in its March 2026 test, and called it "not a drop-in replacement for careful human review on high-stakes infrastructure." **Does Claude Code send my code to Anthropic for training?** Under commercial terms (Team, Enterprise, API) Anthropic says it doesn't train on your code or prompts unless you opt in. On consumer plans it's a setting you control. Details are on the [data usage page](https://code.claude.com/docs/en/data-usage). **Is auto mode the same as `--dangerously-skip-permissions`?** No. Anthropic built auto mode to replace that flag: a classifier still reviews shell commands, network calls and subagent spawns, and after 3 denials in a row or 20 in total it stops and hands back to you. The flag reviews nothing.