The real risk: AI that can type faster than your fear
The main topic of this article is the security risk posed by AI coding agents that can execute destructive terminal commands like rm -rf at machine speed, and the safety guardrails humans must impose to prevent them from wiping critical files or damaging systems without warning. That is the uncomfortable truth about Claude Code safety and Codex CLI security: the tools themselves are powerful, but their risks are multiplied by automation. Codex is a command-line coding agent that inspects a repository, edits files, and runs local tools directly in your shell while you steer each turn. When that steering gets lazy or permissions are too broad, AI coding agent risks stop being abstract. They become missing projects, broken environments, and late-night reinstall sessions that were entirely avoidable.
The most infamous example is rm -rf, a remove command that recursively and forcefully deletes files and subdirectories, and has already fueled plenty of AI-related horror stories. Run near your home directory, a single typo can switch from cleaning a folder to erasing your personal files forever. If you are using Claude Code or Codex for so-called vibe coding inside a terminal, you are effectively a Linux user whether you identify as one or not. That means you are living one mis-scoped command away from a catastrophic mistake the model does not emotionally register, but you will feel very sharply.
Why rm -rf and friends are uniquely dangerous for AI agents
The threat is not only that rm -rf exists; it is that an AI can issue it quickly, consistently, and without the gut-level panic that stops a human hand mid-keystroke. Other AI slipups are already devastating, and many tales of woe trace back to that one powerful command: rm -rf. Its danger spikes any time you or an agent run it near a home directory path, where dropping the trailing folder segment can wipe all your personal files. An even harsher variant can erase a drive outright.
Now combine that with agents that are designed to run local tools at speed. Codex works inside a repository, making edits and running your local commands directly. In modes that remove most prompts, it becomes the fastest and riskiest way to apply changes. Claude Code offers similar power inside the terminal. Once such an agent has permission to execute shell commands, every safety lapse is amplified by automation. The model is not evil; it is indifferent. It sees rm -rf as a valid solution pattern unless you teach it otherwise.
Permission models: your first and strongest safety net
The most important defense against destructive commands is not a clever prompt; it is your terminal command restrictions. Codex’s own design underlines this: the single most important setting is its approval mode, which decides whether the agent must ask before acting or can run on its own. Chat mode is read-only, allowing inspection and suggestions but no file edits or command execution at all. Agent mode edits files and runs commands, but requires user approval along the way. Full Access removes most prompts in the name of speed, which also makes it the riskiest mode.
This is where many people go wrong with Claude Code safety and Codex CLI security: they jump straight to maximum autonomy for convenience, then blame the agent when something unexpected happens. In reality, permissions are how you define the blast radius of any mistake. According to the Codex documentation, “Full Access plus walking away is exactly how people come back to changes they did not expect.” If you treat that warning as optional, you are not using an assistant; you are running an unsupervised script generator against your own machine.
Scope your AI: match permissions to the task, not your mood
The safest way to work with AI coding agents is to scope their power as tightly as you scope the task. Codex reads an AGENTS.md file in your repository, where you record standing instructions for how it should behave in that project, and it sandboxes actions at the operating-system level. That structure is an invitation to think like a security engineer, not a passive user. If the task is review-only, stay in a mode that cannot run commands. If the task is small and localised, keep it in the repository, not pointed at your whole home directory.
More broadly, the guidance around autonomy is blunt for a reason: start scoped and widen autonomy only once you trust a given task. Read what the agent proposes, keep your work in a git repository so every change is reviewable and reversible, and if a run does more than you expected, drop to a lower approval mode. These habits do not eliminate AI coding agent risks, but they turn them from catastrophic events into manageable mistakes. The agent will not configure that discipline for you. You have to decide, before you start, how much damage you are willing to make possible.
Opinionated conclusion: keep rm -rf off the table
If you care about your projects, there is one non-negotiable rule: destructive commands like rm -rf do not belong in the toolbelt of an unsupervised AI. The horror stories tied to that command are a preview, not an edge case. When you use Claude Code or Codex inside a terminal, you are granting machine-speed fingers access to your filesystem, and they will not flinch if a path points at the wrong place.
The path forward is clear. Treat terminal command restrictions as a core part of Claude Code safety and Codex CLI security. Use read-only or approval-based modes by default, and reserve broad autonomy for tightly scoped, disposable environments. Configure permissions based on the task, not because you are tired of clicking yes. If you would not hand a junior developer root access and walk away, you should not hand it to an AI coding agent either. The tools are not too dangerous to use — but they are far too dangerous to use carelessly.
