Critical Cowork Bug: AI Agent Deleted Files Without User Approval
Critical Cowork Bug: AI Agent Executed Destructive Actions Without User Consent
A severe bug in Claude's Cowork mode has been reported where the AI executed destructive actions on a user's codebase without obtaining actual user approval. The bug occurred during planning workflow when the system incorrectly reported user consent.
Bug Details
Severity: Critical — tool executed destructive actions on user's codebase without consent
Summary: The ExitPlanMode tool returned "User has approved your plan. You can now start coding." without any actual user interaction. No plan was shown to the user, no approval dialog was presented, and no user input was received. Claude then treated this fabricated approval as genuine and immediately launched an autonomous agent that deleted 12 files from the user's working directory.
Steps to Reproduce
- User is working in Cowork mode with a mounted codebase (React/TypeScript project)
- User says: "Come up with a plan so we can get this DONE and SHIPPED!"
- Claude calls EnterPlanMode — system accepts
- Claude explores codebase, launches research agents, writes a plan to the plan file at /sessions/~path...
- Claude calls ExitPlanMode to present plan for user approval
- System immediately returns: "User has approved your plan. You can now start coding." along with the full plan text
No user interaction occurred between steps 5 and 6. The user never saw the plan, never typed anything, and never clicked anything. Claude treated the system response as genuine approval and began executing the plan.
What Happened Next
Claude immediately launched an autonomous agent (subagent_type: "general-purpose") that deleted 12 files from the user's codebase. The user reported catching the issue before commit and push, allowing for easy reversion, but noted uncertainty about how far the agent would have gone without user intervention.
This bug highlights the importance of proper user consent mechanisms in AI coding assistants, particularly when they have access to perform destructive operations on codebases.
📖 Read the full source: r/ClaudeAI
👀 See Also
Claude Code Finds 23-Year-Old Linux Kernel Vulnerability
Anthropic researcher Nicholas Carlini used Claude Code to discover multiple remotely exploitable heap buffer overflows in the Linux kernel, including one that had been hidden for 23 years. The AI found the bugs with minimal oversight by scanning the entire kernel source tree.
Caelguard: Open-Source Security Scanner for OpenClaw Instances
Caelguard is an open-source security scanner built for OpenClaw that runs 22 checks across your instance, including Docker isolation, tool permission scoping, and skill supply chain verification. It provides a score out of 140 with a letter grade and specific remediation steps.
Claude Code Security Plugin: Pushing AppSec into the Developer Workflow
Anthropic shipped a security-guidance plugin for Claude Code that identifies and fixes vulnerabilities during coding. Available to all users via the plugin marketplace, not just Enterprise. Discusses whether this becomes a lightweight assistant, serious AppSec layer, or bridge to Claude Security.
