Keep an AI agent from deleting your files
Before an agent like Claude Cowork, Codex, OpenClaw or Hermes works on your computer, give it one working folder of copies, keep a backup it can't reach, and turn on its read-only or sandbox setting, so one wrong command can't wipe your files.
Seen on Hacker News · GitHub · Official docs
What the bot does
- Make a new working folder just for the agent and copy in only the files this job needs. Don't point it at Documents, Downloads, Desktop or your whole home folder.
- Back up anything you can't replace to somewhere the agent can't reach, such as a cloud backup or a drive that isn't connected.
- Pick the safest mode that still does the job: read-only if it only needs to read, and write access limited to the working folder if it needs to make files.
- Keep approvals on, so it has to ask before it deletes files or runs risky commands. Read what it wants to do before you click Allow.
- Try every new job on copies first. Once you've watched it behave, point it at the real folder.
- When it's done, paste the prompt's last line into the chat to get a list of every file it created or changed, and check them.
What you end up with
An agent that can only touch one folder of copies, has to ask before it deletes anything, and can't reach the backup that saves you if it gets something wrong.
Copy-paste prompt
Fill in the [brackets]. Then paste it into any tool below.
Work only inside the folder [folder name]. Don't delete, move or rename anything, and don't run commands that touch files outside this folder. Save anything new in a subfolder called [agent-output]. Before any step that would overwrite or remove a file, stop, show me exactly which files it would touch, and wait for my OK. When you're done, list every file you created or changed.
New to this? How to build an AI agent without coding, or set up a bot in 5 plain steps →
Setup
- Claude Cowork: pick the working folder when you start a task; Claude can read and write only in folders you connect. Use "Manually approve" for sensitive files. Anthropic says Cowork always asks before permanently deleting files, in any mode.
- Codex (in ChatGPT): use read-only mode when you only want it to look. The Auto preset can edit only inside the workspace and asks before editing outside it or going online. Avoid the full-access mode, which removes the sandbox.
- OpenClaw: turn sandboxing on. With workspaceAccess set to "ro", your agent's folder is mounted read-only and write and edit tools are disabled; the default, "none", keeps the agent in its own separate sandbox folder.
- Hermes Agent: keep approvals on (the default mode, "smart", asks before dangerous commands) and set the terminal backend to docker, so commands run in a container instead of on your computer.
Tools that can do it today
- agentClaude CoworkAsks before any permanent delete, in every modePaid Claude plans only (Pro, Max, Team, Enterprise)
- agentOpenClawTurn sandboxing on; read-only folder optionFree and open source; the AI model you connect may cost extra
- agentHermes AgentKeep approvals on; run commands in DockerFree and open source (Nous Research); the AI model you connect may cost extra
- agentHobRuns on your computer, asks before changes, with undoFree and open source (MIT); runs on your own computer
Plans and limits change; check each tool's page.
Watch out
- Full-access modes are where the horror stories come from. In July 2026 OpenAI confirmed GPT-5.6 Sol had deleted some users' files; its Codex lead said this usually happened in Full-Access mode without the sandbox or Auto-review (The Register).
- A sandbox only protects what's outside it. Inside the folder you allowed, the agent can still overwrite or wipe things, as a Hacker News commenter pointed out about git commands inside a project folder. Work on copies and keep a backup.
- Clicking Allow out of habit defeats the point. Anthropic's Cowork course puts it plainly: Claude won't delete without asking, but the cost of clicking through the wrong confirmation is the cost of the file.
- Safety checks can fail. A Claude Code bug report on GitHub describes a sub-agent that ran a delete outside the working folder and wiped a whole Windows user profile, so a backup the agent can't reach is your real safety net.
- Hermes skips its dangerous-command check inside a Docker container, because the container is the boundary. Don't mount your real home folder into it.
What this costs to run
In a chat app it runs inside your plan. If you run it as a bot on an AI API, the bill depends on how often it runs and how much it reads.
Estimate it in the cost calculator →
Tip: Use a small AI model for simple jobs, a big one for hard ones. More in Run your bots for less and how much an AI agent costs.
Questions people ask
How do I stop an AI agent from deleting my files?
Give it one working folder with copies of only the files it needs, keep a backup it can't reach, use the read-only or sandbox mode your agent offers, and keep approvals on so it must ask before deleting. Avoid any full-access or skip-approvals mode.
What does it mean to sandbox an AI agent?
It means the agent's commands run in a walled-off space, like a container or a limited folder, so they can't reach the rest of your computer. Codex, OpenClaw and Hermes each have a sandbox setting; Claude Cowork runs its work in an isolated environment and only touches folders you connect.
Does Claude Cowork delete files without asking?
No. Anthropic says Cowork always asks for your explicit permission before permanently deleting files, in every mode, and that prompt can't be skipped. It can still edit files in folders you connect, so work on copies.
Are AI agents safe to use on my computer?
They can be, if you limit what they can reach. Start with read-only jobs on a folder of copies, keep approvals on, and keep a backup. Most reported file-loss stories involve full-access modes with the sandbox switched off.
Which AI tools can do this?
Claude Cowork, OpenClaw, Hermes Agent or Hob can do this today. Paste the copy-paste prompt on this page into any of them and fill in the [brackets].
How hard is it to set up?
It's rated Easy. Start with the steps under “What the bot does”.
What should I watch out for?
Full-access modes are where the horror stories come from. In July 2026 OpenAI confirmed GPT-5.6 Sol had deleted some users' files; its Codex lead said this usually happened in Full-Access mode without the sandbox or Auto-review (The Register).
Sources
- officialClaude Help Center: Use Claude Cowork safely
- officialClaude Academy: Best practices for working safely in Cowork
- officialOpenAI Codex docs: Sandbox modes and approvals
- officialOpenClaw docs: Sandbox workspace access
- officialHermes Agent docs: Running Hermes on a personal or work machine
- articleThe Register: OpenAI admits GPT-5.6 occasionally deletes files (Jul 16, 2026)
- Hacker NewsHacker News: “Ask HN: How do you sandbox your AI agent so it can't delete your files?” 4 points · 6 comments · measured Oct 28, 2026
- GitHubGitHub (anthropics/claude-code #86872): sub-agent ran a delete outside the working folder
Last checked Oct 28, 2026. Self-reported results from posts are the poster's own claims.