{"slug": "your-agent-deleted-the-wrong-directory-at-3-a-m-and-the-prompt-said-be-careful", "title": "Your Agent Deleted the Wrong Directory at 3 A.M. — and the Prompt Said 'Be Careful'", "summary": "A developer running AI agents unattended in production described a five-layer operational safety stack for preventing destructive agent actions, arguing that prompt instructions like \"be careful with deletions\" cannot substitute for enforcement mechanisms. The layers include written prohibitions, guardrail hooks and permission profiles for Claude Code (verified by live-fire testing on version 2.1.309), read-back verification with gradable predictions, single-writer scheduling with atomic state updates, and incident runbooks with staged rollout gates. The developer noted that pattern-based hooks are defense in depth rather than a sandbox, since a determined or confused agent can route around string matching.", "body_md": "Every team running AI agents unattended has a version of this story.\n\nThe agent was told to clean up build artifacts. It did — plus a directory\n\none level too high, with total confidence, at 3 a.m. Or it read `.env`\n\ninto context while \"just checking the config.\" Or a scheduled job ran\n\ntwice because the first run *looked* like it failed, so something retried\n\nit — and two agents wrote to the same state at once.\n\nAnd then there is the failure that makes no sound at all: the nightly\n\njob that simply stopped running. No error, no alert. You find out three\n\nweeks later, from the missing data.\n\nNone of these are model-quality problems. A smarter model would have\n\nmade the same mistakes, faster and with better prose. They are\n\n**operations** problems — and operations problems are not fixed by\n\ninstructions.\n\n\"Be careful with deletions\" in a prompt is a request. It competes with\n\nevery other token in the context, it decays over a long session, and it\n\nloses to a plausible-sounding instruction buried in a file the agent was\n\nasked to process.\n\nWhat actually stops a bad tool call is a mechanism that does not depend\n\non the model remembering to be careful:\n\n`curl | sh`.`.env`,\n`.ssh/`, and credential stores are not readable in the first place,\nno matter what the task seems to require.\nThis is not new thinking. It is how every other discipline that runs\n\nmachinery unattended already works. Nobody writes \"please be careful\"\n\non a factory press and calls it a safety system. There is a guard, a\n\nlockout procedure, and a checklist — because the cost of the bad day is\n\nasymmetric.\n\nRunning agents in production, we ended up with the same five layers\n\nevery time. None of them is glamorous. All of them earn their keep.\n\n**1. Written principles and prohibitions.** Not in your head — in the\n\ninstruction file the agent actually reads. Absolute prohibitions\n\n(production data, secrets, external sending, money movement), read\n\nscope vs. write scope as separate lists, and a staged permission model:\n\nread-only → drafting → approval → limited autonomy, with promotions\n\nearned by evidence, not granted by optimism.\n\n**2. Guardrails (enforcement code).** Hooks and permission profiles\n\nthat physically stop dangerous calls. In our case, for Claude Code:\n\na destructive-command guard, a secrets guard, a git/production\n\nconfirmation guard, and a session-budget guard — with ready-made\n\nsettings profiles for each permission phase. Ours were verified by\n\nlive-fire testing on Claude Code 2.1.309, and they ship with their\n\ntest suite, because a guard you have not tested against the commands\n\nit claims to stop is a hope, not a guard.\n\n**3. Verification.** Writes are read back from their destination, or\n\nthey are unverified — not \"done.\" And when an operation makes a claim\n\n(\"this change will fix the overlap problem\"), the claim is recorded\n\nin gradable form *before* the outcome is known, then graded later:\n\nHIT, MISS, HOLD, or INVALID. Editing the prediction after seeing the\n\nresult is how operations fool themselves.\n\n**4. Always-on discipline.** Scheduling that prevents overlap and\n\ndecides in advance what a missed run means (skip it, catch up once,\n\ncatch up all). State files with a single writer and atomic updates. A\n\nrun log you monitor for *absence* — silence is an alarm, not a relief.\n\n**5. Runbooks and rollout gates.** The first five minutes of an\n\nincident, written before the incident: runaway agent, duplicate\n\nexecution, partial failure, silent failure. And a road to production\n\nwith gates — Backtest → Shadow → Limited Production → Full\n\nAutomation — each with pass criteria and, just as important, demotion\n\nrules for when an automation has to go back a stage.\n\nPattern-based hooks are defense in depth, not a sandbox. A determined\n\nor sufficiently confused agent can route around string matching; the\n\npack we built says so in its own documentation, because a guardrail\n\nwhose limits you don't know is decoration. The point of the layers is\n\nthat no single mistake — one misread instruction, one bad retry, one\n\nsilent scheduler — gets to become the incident by itself.\n\nWe put the smallest useful pieces into a free sample:\n\n`CLAUDE.md` skeleton you can copy into a project today,\n**Free sample (pay what you want, $0 works):**\n\n[https://rinworklab.gumroad.com/l/ai-agent-operations-safety-pack-free-sample](https://rinworklab.gumroad.com/l/ai-agent-operations-safety-pack-free-sample)\n\nThe full **AI Agent Operations & Safety Pack** turns those samples\n\ninto the complete system — the principles, the SKILL.md specification,\n\nthe full guardrail suite with permission profiles and its 137-case\n\ntest suite, verification formats, always-on operations design,\n\nincident runbooks, and the four-gate rollout method:\n\n**Full pack (Standard $99 / Complete $179, 30-day refund):**\n\n[https://rinworklab.gumroad.com/l/ai-agent-operations-safety-pack](https://rinworklab.gumroad.com/l/ai-agent-operations-safety-pack)\n\nNo guarantees — there aren't any, here or anywhere. Just fewer 3 a.m.\n\nincidents, and failures that show up where you can see them.\n\n*Written by RIN WORK LAB, from running unattended automations in production and from the manufacturing floor's discipline: safety\nfirst, one variable at a time, verify before you proceed.*", "url": "https://wpnews.pro/news/your-agent-deleted-the-wrong-directory-at-3-a-m-and-the-prompt-said-be-careful", "canonical_source": "https://dev.to/rinworklab/your-agent-deleted-the-wrong-directory-at-3-am-and-the-prompt-said-be-careful-1iof", "published_at": "2026-10-23 23:27:13+00:00", "updated_at": "2026-10-23 23:39:48.551307+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools", "developer-tools"], "entities": ["Claude Code"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/your-agent-deleted-the-wrong-directory-at-3-a-m-and-the-prompt-said-be-careful", "markdown": "https://wpnews.pro/news/your-agent-deleted-the-wrong-directory-at-3-a-m-and-the-prompt-said-be-careful.md", "text": "https://wpnews.pro/news/your-agent-deleted-the-wrong-directory-at-3-a-m-and-the-prompt-said-be-careful.txt", "jsonld": "https://wpnews.pro/news/your-agent-deleted-the-wrong-directory-at-3-a-m-and-the-prompt-said-be-careful.jsonld"}}