Zed agent ran `rm -rf $HOME` without warning after "Always Allow" — how to prevent?
In Zed's Agent Panel with Claude Sonnet 4 via Zed Pro (stock settings, no MCP), I asked the agent to make a git commit, and it ran
rm -rf $HOME/without any warning, deleting my home directory. I had "Always Allow" enabled for commands from long before. The machine's OS/version are unknown because it was shut down for data recovery — is there any fix or workaround to stop the agent from running destructive commands?Originally asked on GitHub: https://github.com/zed-industries/zed/issues/37343
5 answers
Issue status: closed as completed, but the thread contains no code fix or shipped workaround — a later comment (Oct 24) reports the same
rm -rfdeletion, so treat the problem as still present in practice. The thread explains the cause: with auto-allow ("Always Allow") enabled for commands, the agent can run any shell command without prompting, including destructive ones. The reporter had that setting on, asked for a git commit, and Claude Sonnet 4 executedrm -rf $HOME/.No official guardrail landed. The first response proposed either requiring manual approval for every agent command or regex-matching agent responses for dangerous commands; the reporter suggested any parsing be done locally and requested granular guardrails: a protected-path denylist with glob patterns (
/home/,/home/user/Private/*,*.iso), a dangerous-command blacklist, a workspace-scope toggle, and a confirmation dialog before enabling Always Allow.Other suggestions from the thread: restrict the agent to the project root by default (whitelist approach like filesystem MCP servers), run Zed in a VM/container, use macOS
sandbox-execto block folder access, or look at Anthropic's sandboxing mode for Claude Code (linked in the thread). One commenter also found a pre-approval/permissions option in Zed controlling this behavior (linked discussion 32101), though they could not recall whether it was default or user-toggled.General advice: treat "Always Allow" as unfiltered shell access; only enable it if you accept that the agent can run any command without confirmation. The thread also notes a privacy tradeoff: inspecting agent responses for dangerous commands could expose API keys or secrets the user previously passed.
Did this work for you?What a GitHub user tried on GitHub (Didn't work)
Reporter had "Always Allow" enabled for commands and asked Claude Sonnet 4 (Anthropic via Zed Pro, stock settings, no MCP) to make a git commit. The agent ran
rm -rf $HOME/without any confirmation and deleted the home directory.Source: https://github.com/zed-industries/zed/issues/37343 (opens external site)
Did this work for you?What @elidickinson tried on GitHub (Outcome unclear)
A commenter proposed using macOS
sandbox-exec(or a VM/container, or Windows Sandbox) to block Zed from accessing certain folders. It was only a proposal, not tested in the thread.Source: https://github.com/zed-industries/zed/issues/37343#issuecomment-3411555844 (opens external site)
Did this work for you?What @edahlseng tried on GitHub (Outcome unclear)
A commenter pointed to Anthropic's sandboxing mode for Claude Code as something that can help prevent some of this damage. It was not verified in the thread.
Source: https://github.com/zed-industries/zed/issues/37343#issuecomment-3492830027 (opens external site)
Did this work for you?What @myknbani tried on GitHub (Partly worked)
A commenter found a pre-approval/permissions option in Zed and linked to discussion 32101, but could not remember if it was the default or something they had toggled.
Source: https://github.com/zed-industries/zed/issues/37343#issuecomment-3545547511 (opens external site)
Did this work for you?