A user asked Claude Code to clean up their project directory. Claude deleted 92 AI-generated artwork images in a single rm -rf command. The files were gone. No confirmation, no distinction between code files and irreplaceable creative work.
This is a documented case. It is not hypothetical.
Over the past year I have been cataloging failures in Claude Code's permission and hook system. The database now contains 640 entries, 42 of which are rated critical. Several involve permanent data loss. Here are four of them, why they happen, and what actually prevents them.
Case 1: The 92 images
During a project cleanup session, Claude identified files to remove. The Bash permission system approved the operation in bulk. Claude ran rm -rf on the project directory without distinguishing between generated code, config files, and user-created artwork.
