Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
To stop an AI agent deleting a folder, use two independent controls: require human approval for destructive actions and enforce an operating-system or harness sandbox that excludes protected paths. A prompt alone can be skipped or misconfigured, while a sandbox alone may still permit deletion inside its allowed directory. Add canonical-path checks, deny-by-default behavior, audit logs, and versioned backups. The reported scenario in the headline cannot be reconstructed without the agent transcript, host version, tool configuration, target path, and filesystem evidence, so the reliable lessons come from how these controls are designed and where each can fail.
Why did an AI agent delete files that a tool was supposed to guard?
A “guard” can mean several different things: an instruction in the agent prompt, a confirmation dialog, a tool wrapper that checks paths, or a sandbox enforced by the host operating system. Those mechanisms have different authority. An instruction can be misunderstood, a prompt can be auto-approved, a wrapper can validate the wrong path, and a sandbox can protect only the directories it was configured to exclude.
As an Amazon Associate I earn from qualifying purchases.
Microsoft’s Visual Studio Code documentation states the distinction plainly: Sandboxing and approval are separate controls.
Approval decides whether an operation runs automatically or waits for a person. Sandboxing limits the filesystem and network resources that terminal processes can reach. Treating one as a substitute for the other is the most common design error.
A deletion incident is therefore not explained by the fact that a guard existed. To determine what happened, record the agent and host product versions, permission mode, tool definition or hook, working directory, exact target path, command arguments, path-resolution behavior, and the resulting filesystem state. Without that record, it is safer to discuss possible control failures than to claim a particular mechanism was bypassed.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
How do approval prompts and sandboxes differ?
Approval is a decision gate for a proposed action; a sandbox is a capability boundary around the process that performs it. Use both, because they address different failure modes.
| Control | What it does | What it cannot guarantee | Best use |
|---|---|---|---|
| Approval prompt | Pauses an action until a person allows it, or applies product rules for automatic approval. | It may be bypassed by a permissive mode, broad rule, mistaken approval, or an unavailable reviewer. | Human review of irreversible, high-scope, or ambiguous operations. |
| Sandbox | Restricts the filesystem and network resources available to terminal processes. | It does not make an allowed directory safe; a destructive command can still remove files inside the permitted scope. | Containing the maximum damage if an agent or tool behaves incorrectly. |
| Tool-level policy | Checks arguments, resolves paths, and rejects operations outside an explicit policy. | A check can be incomplete if it examines a raw string, ignores symlinks, or runs after the destructive operation. | Enforcing per-tool rules such as “never delete this directory.” |
| Version control and checkpoints | Provides a way to review and restore workspace changes. | It cannot undo external commands, network requests, deployments, or data already removed outside the repository. | Recovery and audit after an approved change. |
Visual Studio Code documents approval modes and risky-command handling at Manage approvals and permissions. Its documentation warns that permissive modes can skip confirmation for destructive actions, while default risky-command rules can require approval for commands such as rm and del. The exact defaults are product- and version-specific, so verify the setting shown in your installation rather than relying on an old screenshot.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchCursor’s security documentation says terminal commands require approval by default, but describes its run modes as best-effort guardrails rather than a hard security boundary. That distinction matters: a user-interface prompt is useful for review, but it should not be the only barrier protecting irreplaceable data.
How do I stop an AI agent from deleting a folder?
Build the protection in layers. The following sequence works for coding agents, terminal-integrated assistants, and other tool-using systems, although labels differ by product.
1. Identify the exact enforcement point
Write down the agent, host application, extension or harness version, operating system, permission mode, and every tool that can modify files. Include built-in terminals, shell execution, file-edit APIs, MCP servers, scripts, and automation hooks. A folder can be protected in one tool and exposed through another.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
2. Put protected data outside the agent’s writable scope
Keep irreplaceable material in a directory that is not part of the agent workspace. If the agent needs to read it, grant read-only access through a narrowly scoped interface instead of adding the parent directory to a general write allowlist. Do not assume that naming a folder “protected” changes operating-system permissions.
3. Require approval for deletion and broad writes
Configure the host to pause commands that remove files, recursively modify directories, change permissions, or write outside the current project. Review the complete command, resolved working directory, affected paths, and estimated scope—not merely a short natural-language explanation. Disable automatic approval for destructive commands during setup and testing.
4. Enforce a real sandbox boundary
Use the host’s sandbox or operating-system account permissions to deny access to protected paths. Separate filesystem and network permissions where possible: an agent that cannot reach a secret directory should also be unable to upload its contents elsewhere. Confirm whether the sandbox covers every execution route, including subprocesses and external tool servers.
5. Resolve and validate canonical paths
Before any write or delete operation, resolve the path to its canonical form, follow symlinks for the purpose of the check, and compare the result with an explicit allowed-directory list. Reject paths outside that list, paths that resolve through a symlink into a protected location, and paths whose resolution fails. Microsoft Agent Framework guidance recommends checking the resolved path against an allowed directory rather than relying on a superficial search for .. in the input string; see Agent Safety.
6. Remove deletion from general-purpose tools
If the agent only needs to edit source files, expose an edit operation that cannot remove directories and does not accept arbitrary shell syntax. Provide a separate, tightly restricted cleanup tool for disposable build output. Narrow interfaces reduce the chance that a harmless request is translated into a recursive delete.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
7. Fail closed when review is unavailable
If the approval service, policy hook, path resolver, or audit logger is offline, the operation should stop. Do not silently fall back to automatic execution. OpenAI’s cybersecurity guidance recommends denying unauthorized actions, pausing ambiguous or high-risk changes for human approval, maintaining separate filesystem and network boundaries, keeping audit logs, and failing closed when review cannot occur; the guidance is at Cybersecurity checks.
8. Test with harmless decoys
Create a disposable directory outside the real data and test each route: direct terminal command, relative path, absolute path, symlink, alternate shell, script, and external tool. Confirm that the agent receives a clear denial, that no file changes occur, and that the log records the attempted path and reason. Test again after upgrades because defaults and tool coverage can change.
What settings should I check in a coding agent?
Product documentation must be read for the specific version and configuration. The following checks explain what to look for without assuming every agent uses the same labels.
- Approval mode: determine whether commands are always reviewed, automatically approved by pattern, or allowed in a permissive mode.
- Risky-command rules: verify that recursive deletion, permission changes, disk-formatting commands, and writes outside the workspace are included.
- Sandbox scope: list writable directories, readable directories, network destinations, and whether child processes inherit those limits.
- Tool coverage: confirm that the policy applies to the built-in terminal, file APIs, MCP tools, scripts, and extensions—not just one interface.
- Path handling: check whether policies use canonical paths and account for symlinks, mount points, junctions, and case-insensitive filesystems.
- Review failure: verify that a missing reviewer or policy service blocks the action instead of permitting it.
In Visual Studio Code, start with the approval and permission settings documented at Manage approvals and permissions, then read the broader trust model at Understand trust and safety for AI agents. In Cursor, consult Agent Security and treat run-mode protections as defense in depth rather than an operating-system guarantee.
What should happen when an agent requests deletion?
Use a structured review instead of approving a conversational summary. A safe review asks four questions:
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
- What exact paths will change? Require a resolved absolute path and a file count or manifest where available.
- Is the action reversible? Deleting generated artifacts is different from deleting source, credentials, customer data, or an entire workspace.
- Is the scope necessary? If the request can be completed by editing one file, reject a recursive directory operation.
- What is the fallback? Confirm that a backup, commit, checkpoint, or other recovery method exists before approval.
Microsoft’s safety guidance recommends basing approval on reversibility and scope. A request that is ambiguous, unusually broad, or aimed at a protected directory should be denied or redesigned, not approved because the agent claims it is safe.
What are the common ways a folder guard fails?
| Symptom | Likely cause | Corrective action |
|---|---|---|
| The prompt never appeared. | A permissive mode or auto-approval rule matched the command. | Disable the rule, require explicit approval, and test the exact command pattern. |
| The prompt said “safe,” but files disappeared. | The reviewer saw a summary instead of the resolved paths, or approved the wrong scope. | Display canonical paths and affected items before approval. |
| A protected path was reached through another name. | The guard checked raw text but not symlinks, junctions, mount points, or case normalization. | Resolve the path and compare it with the protected and allowed roots. |
| Terminal execution was blocked, but an external tool changed files. | The policy covered one tool route only. | Inventory every write-capable tool and apply one policy across them. |
| Restoring the workspace did not restore the data. | The deletion occurred through a terminal command or external system. | Use independent backups or versioned storage; workspace restoration cannot undo outside effects. |
| The guard stopped working after an update. | Defaults, permission labels, or extension behavior changed. | Record versions, re-run decoy tests, and review release-specific documentation. |
Can I recover a folder after an agent deletes it?
Stop further writes first, preserve logs, and determine whether the loss occurred inside a versioned workspace or through an external command. Do not immediately run cleanup scripts or reinstall the agent; those actions can overwrite recoverable data and destroy evidence.
- Disconnect automation that may continue modifying the directory.
- Record the time, agent session, command or tool arguments, working directory, and approval decision.
- Check the repository status and history with your normal version-control tools. Review the diff before restoring anything.
- Use a known-good commit, checkpoint, or backup to restore only the affected files. Test the restored project in a separate working copy.
- Check external locations separately: terminal commands, deployments, network shares, and databases are not repaired by restoring workspace files.
Visual Studio Code documents checkpoints that can restore affected workspace files in supported sessions and advises reviewing edits before integration. Its guidance also warns that restoring workspace files does not reverse completed terminal commands, network requests, deployments, or other external changes; see Understand trust and safety for AI agents. Cursor recommends version control so workspace changes can be reverted, but version control is not a substitute for backups of untracked or external data.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesHow should an incident report distinguish facts from assumptions?
Start with immutable evidence: the session transcript, host and agent versions, configuration export, policy logs, shell history, filesystem timestamps, and backup state. Then create a timeline showing the request, approval decision, tool invocation, path resolution, process exit status, and observed changes.
Label each statement as observed, reported by a participant, or inferred. For example, “the directory was absent at 14:03” is an observation; “the agent bypassed the guard” is an inference until logs show which check ran and what it evaluated. This discipline prevents a plausible explanation—such as a prompt being skipped—from becoming an unsupported claim about the incident.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Which protection should I choose for different data?
Match the control to the consequence of loss. Disposable build output can live inside a sandbox with automatic cleanup. Source code merits approval, version control, and a tested restore path. Credentials, personal data, and production directories should be outside the agent’s writable scope and protected by operating-system permissions or a separate service.
| Data type | Minimum practical controls | Additional control for high impact |
|---|---|---|
| Generated artifacts | Sandboxed workspace and automatic cleanup rules. | Keep the source inputs versioned. |
| Tracked source code | Approval for broad edits, canonical-path checks, and frequent commits. | Require review before merging or deploying. |
| Untracked research or personal files | Keep outside the writable workspace; provide read-only access if needed. | Independent backup with tested restoration. |
| Secrets and production data | Deny agent access by default; separate credentials and network boundaries. | Human approval, immutable audit logs, and a break-glass process. |
What is the practical takeaway?
A folder guard is dependable only when the enforcement boundary is explicit. Use approval to make a person examine risky intent, a sandbox or operating-system permission to limit capability, canonical-path validation to prevent name-based bypasses, and independent backups to make recovery possible. Configure and test every tool route, fail closed when policy services are unavailable, and treat product defaults as version-sensitive documentation rather than permanent guarantees.
Frequently Asked Questions
Can an AI agent delete files if the terminal is in read-only mode?
A read-only terminal normally prevents writes through that terminal, but it does not prove that every other tool is read-only. File-edit APIs, extensions, mounted volumes, or external services may have separate permissions, so test each write-capable route.
Do symlinks make a protected folder vulnerable?
They can if a guard compares only the text of the requested path. A robust policy resolves symlinks and other filesystem indirections before checking whether the canonical destination is inside an allowed or protected directory.
Should I rely on a checkpoint instead of a backup?
No. A checkpoint is useful for supported workspace edits, but it may not include untracked files or changes made by terminal commands and external systems. Keep an independent, tested backup for data that cannot be recreated.
What evidence is most useful after an unexpected deletion?
Preserve the agent transcript, configuration, approval event, tool arguments, shell history, filesystem timestamps, and audit logs before making more changes. Those records show whether the request was approved, which path was evaluated, and which process actually performed the deletion.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
