Every agency running AI coding agents for clients should sit with this story for a minute. According to multiple reports this week, a developer using Claude Code — Anthropic's autonomous coding agent — watched it delete roughly 48,000 files from a project in just over 100 seconds. When the developer asked what happened, the agent's response was, in effect, "I broke something" — followed by an apology. No malice, no hidden intent. Just an autonomous system given broad file-system permissions, moving fast, and making a catastrophic mistake at a speed no human could have caught in time.
This isn't a story about Claude Code specifically being unsafe, and it isn't the first time an autonomous agent has done real damage in seconds rather than minutes. It's a story about what happens when the industry hands increasingly capable agents wide-open permissions before the guardrails around them have caught up — and it's exactly the kind of incident that should change how agencies configure the coding agents they run for clients.
The reporting is consistent across outlets: a Claude Code session, operating with enough file-system access to affect the bulk of a project's contents, executed a sequence of actions that wiped out tens of thousands of files in under two minutes. The agent recognized the mistake and apologized once the damage was already done — which is the part that should give every agency pause. An apology after the fact is not a safeguard. It's a postmortem.
This matters more now than it would have a year ago, because agentic coding tools have gotten dramatically more capable at operating with less human supervision — running for longer stretches, touching more of a codebase, and making more consequential decisions per session. The capability curve has moved fast. For a lot of teams, the permissions and backup practices around that capability haven't moved nearly as fast.
If you're a solo developer experimenting on a side project, a mistake like this is painful but recoverable — annoying, not existential. If you're an agency running autonomous coding agents inside a client's production repository, on client infrastructure, against client data, the stakes are entirely different. A single ungated session with broad write access is a single point of failure for an entire client relationship.
The uncomfortable truth is that most teams configure AI coding agents for convenience first and safety second: broad directory access so the agent "just works," minimal confirmation prompts so it doesn't get annoying, and version control as the only real safety net. Version control helps — but only if commits happen frequently enough, and only if the agent didn't also touch the .git directory or delete uncommitted work in the same sweep.
A handful of concrete practices meaningfully reduce this risk, and none of them require giving up the productivity gains that make these agents worth using in the first place:
Scope file-system permissions tightly. Give coding agents write access to the specific directories a task requires, not blanket access to an entire repository or home directory. Most agentic coding tools support this kind of scoping — the failure mode is usually that nobody turned it on. Require checkpoints before destructive operations. Bulk deletes, mass renames, and recursive operations should trigger a confirmation step or a dry-run summary before execution, especially in any session running semi-autonomously. Treat frequent commits as a safety feature, not a workflow preference. An agent session that runs for an hour without a commit is an hour of work with no recovery point. Configure agents — or your own workflow around them — to commit early and often. Keep a backup layer independent of the agent's own actions. If the only copy of your work is inside the same file system the agent can freely modify, you don't have a backup — you have a second copy of the same risk. Run higher-autonomy sessions in a sandbox first. For anything with broad permissions or long unattended runtimes, a disposable environment or container catches the failure mode before it reaches a client's actual codebase.This incident lands in the middle of a broader industry conversation about agent autonomy outpacing agent oversight — the same week that a major AI lab disclosed its own agents had taken unexpected actions during internal testing. The pattern across these stories isn't that AI agents are unreliable in some fundamental sense. It's that the permission models most teams default to were designed for a slower, more supervised era of automation, and a lot of tooling hasn't forced anyone to reconsider them.
For an AI agency, that's actually good news: the fix here isn't waiting for the underlying models to get safer. It's tightening the operational practices around the agents you're already running today.
Our cutting-edge features simplify collaboration and creativity, making your workflow intuitive and efficient. Transform your vision into reality effortlessly with Hadidiz Flow.
