Claude Code Now Refuses to Nuke Your Repo in Auto Mode

TL;DR

Claude Code 2.1.183 (shipped June 19, 2026) added a small set of auto-mode safety rules that matter more than the changelog line makes them look. When the agent is running unattended, it now hard-blocks the commands that silently destroy work you cannot get back: git reset --hard, git checkout -- ., git clean -fd, git stash drop, an out-of-turn git commit --amend, and terraform destroy / pulumi destroy / cdk destroy. Unless you explicitly asked for that exact destructive action, the agent will not run it. This is the missing guardrail for the approve-approve-approve workflow that agentic coding has been drifting toward all year.

What actually changed

The release notes are terse, so here is the precise behavior, straight from the changelog. In auto mode, Claude Code now treats a specific class of commands as unconditionally dangerous and refuses them unless your prompt clearly called for discarding work:

• Destructive git commands (git reset --hard, git checkout -- ., git clean -fd, git stash drop) are blocked when you did not ask to throw away local changes.
• git commit --amend is blocked when the commit being amended was not made by the agent in this session. No more silently rewriting a commit you authored by hand.
• terraform destroy / pulumi destroy / cdk destroy are blocked unless you asked for that specific stack. The agent cannot decide on its own to tear down infrastructure.

The same release also added a model deprecation warning: if you request a model that has been retired or auto-upgraded to a newer one, Claude Code now tells you on stderr, including in print mode (-p) and for models pinned in agent frontmatter. Small, but it kills a whole category of "why is my output different today" confusion in scripts.

Why this is a bigger deal than it reads

Think about the failure mode these rules prevent. You hand the agent a task, walk away, and it hits a messy working tree or a merge conflict. The "helpful" thing a model has historically been tempted to do is clean the slate: git reset --hard to a known-good commit, or git clean -fd to wipe untracked files. Both feel like progress. Both are irreversible. A hard reset throws away uncommitted work with no reflog entry to save you, and git clean -fd deletes untracked files that git was never tracking in the first place, so there is nothing to recover.

The danger of an autonomous coding agent was never that it writes a bad function. You catch that in review. The danger is the destructive shell command that runs in the half second before you look up from the other tab.

These are exactly the commands that turn "the agent made a mess" into "the agent ate three hours of uncommitted work." Blocking them by default, while still allowing them when you explicitly ask, is the right shape for a guardrail: it stops the surprise, not the intent.

How auto mode got here

This is the latest patch on a feature that has been hardening for months, and the trajectory is worth seeing as a whole. Auto mode is Anthropic's middle path between approving every single permission prompt by hand and the nuclear --dangerously-skip-permissions flag that turns off the brakes entirely.

• March 2026: auto mode landed in research preview. A classifier handles routine permission prompts so safe actions run uninterrupted and risky ones get stopped.
• May 2026: it expanded to the Pro plan and added Sonnet 4.6 alongside Opus, replacing prompts with background safety checks for far more users.
• June 2026: it reached third-party providers, running on Bedrock, Vertex, and Foundry for Opus 4.7 and 4.8.
• June 19, 2026: 2.1.183 adds the explicit destructive-command blocklist on top of the classifier.

The pattern is clear. As autonomy gets handed to more people on more surfaces, the safety floor has to come up to meet it. A classifier guessing what is risky is good. A hard-coded refusal on the handful of commands that are always catastrophic when unrequested is better, because you do not want a probabilistic judgment call standing between your uncommitted work and oblivion.

What it does not do

Be clear-eyed about the scope so you do not over-trust it. This is a targeted blocklist, not a sandbox.

• It covers a specific, enumerated set of commands. A creative rm -rf, a destructive database migration, or a force push is not on this particular list. Do not read "blocks destructive commands" as "cannot destroy anything."
• It is an auto mode behavior. If you run with --dangerously-skip-permissions, you have opted out of the brakes by name, and that is on you.
• "Unless you asked" means intent is inferred from your prompt. If you literally tell it to reset hard, it will. The guardrail is against unrequested destruction, not against you.

None of that diminishes the change. It just means the right mental model is "seatbelt," not "roll cage."

Why a builder should care

1. The autonomy curve finally has a floor

Every month the default workflow drifts closer to "let it run." That is great for throughput and terrible the one time the agent decides a clean slate is the fix. Default-blocking the irreversible commands means you can lean into unattended runs with meaningfully less pucker factor.

2. Your safety net is still your job

The most reliable protection against an agent eating your work is the same as the protection against eating your own: commit early, commit often, and let the agent work on a branch or a worktree. This release reduces the blast radius of a bad call. It does not replace clean git hygiene, and it would be a mistake to treat it as permission to stop committing.

3. Infrastructure blocking is the quiet headline

The git rules will get the attention, but terraform destroy / pulumi destroy / cdk destroy being blocked unless you name the stack is arguably the scarier class of accident to prevent. An agent with cloud credentials and a destroy command is a very different risk than one that can churn a working tree. If you let agents anywhere near IaC, this is the line that should make you exhale.

4. Pin and check your models

The deprecation warning is a small quality-of-life win with real teeth in automation. Models get retired and silently upgraded; if your eval suite or CI pipeline pins a model in frontmatter, you now get told on stderr when that pin no longer points where you think. Wire that warning into your logs.

The honest take

This is not a flashy release. There is no new model, no benchmark, no demo. It is a maintenance patch that closes a specific, well-known way for autonomous agents to ruin your day, and it ships the protection on by default rather than as an opt-in flag most people would never find. That is exactly the kind of unglamorous safety work that should happen more often and get celebrated less reluctantly. If you run Claude Code unattended, update and move on with slightly more confidence.

Key Takeaways

• Claude Code 2.1.183 (June 19, 2026) blocks destructive git commands (git reset --hard, git checkout -- ., git clean -fd, git stash drop) in auto mode unless you asked to discard work.
• It also blocks out-of-turn git commit --amend and terraform/pulumi/cdk destroy unless you named the specific stack.
• A new model deprecation warning prints to stderr (including -p mode and agent frontmatter) when your requested model is retired or auto-upgraded.
• This is the latest step in auto mode hardening: classifier preview in March, Pro and Sonnet in May, Bedrock/Vertex/Foundry in June, now hard-coded destructive-command blocking.
• It is a targeted blocklist, not a sandbox. Keep committing early and running agents on branches or worktrees.
• The infrastructure-destroy block may matter more than the git rules if your agents touch IaC.

Sources: Claude Code CHANGELOG (anthropics/claude-code), Claude Code: What's new, Releasebot: Claude Code updates