Short answer: if an AI agent has just deleted your files, stop it, then check the Trash, your cloud service's deleted files and your backups, in that order. Most agents delete with terminal commands that skip the Trash, so if none of those has a copy, the files are probably gone. VaultSort Safety Net is there so that next time doesn't depend on luck. It keeps a history of the folders you protect, in a place an agent running as you can't read, change or delete. When hundreds of files are deleted or changed at once, it offers to put the whole folder back as it was moments before, in one click.
This post covers what has been happening, what to do right now if it happened to you, what an AI safety net has to do, and how Safety Net does it, including what it doesn't do.
AI agents are deleting real files
AI agents no longer only suggest changes. Claude Cowork, Claude Code, Codex, Cursor and similar tools act on your Mac with your permissions. Usually that goes well. Some well-documented cases went badly:
- About 15,000 family photos (February 2026). Nick Davidov asked Claude Cowork to clear temporary Office files from his wife's desktop. The agent deleted a folder holding about 15 years of family photos with terminal commands, so nothing went to the Trash. He got them back only because iCloud keeps deleted files for 30 days (UC Strategies).
- A recursive delete of home folders (July 2026). GPT-5.6 Codex, running with full file access and no sandbox, aimed a recursive delete at users' real home folders. OpenAI said it was looking into a small number of reports and described the behaviour as extremely rare (Cybersecurity News).
- Apple named the risk (October 2026). Apple said Full Disk Access will need very explicit user action, and that the risks of broad access grow as AI agents become more capable and autonomous (The Star, via Bloomberg).
None of these was malicious. An agent was asked to tidy up, read the request more broadly than intended, and used the shell to do it. That last part matters, because an agent's own undo usually doesn't cover the shell. Claude Code's checkpoints, for example, track edits made with its file-editing tools, but not files changed by Bash commands such as rm or mv. A command like rm -rf doesn't use the Trash either. Once it runs, the only copies left are the ones something else kept.
If an AI agent just deleted your files
Work through this list before trying anything clever.
- Stop the agent. End the session or press Ctrl+C. Don't ask it to fix the problem: it may keep "cleaning up".
- Don't save or install anything on that disk yet. On a Mac's SSD, file-recovery software rarely gets anything back, because the drive clears freed space quickly. The steps below are far more likely to work.
- Check the Trash. Some tools do use it.
- Check your cloud service. If the folder was in iCloud Drive, Dropbox, OneDrive or Google Drive, look in that service's deleted files. iCloud keeps them for 30 days, which is how the 15,000 photos came back.
- Restore from a backup. Time Machine, or whatever else you use.
- For code, use Git. In a Git project, tracked files can be restored with
git restore. Files that were never committed can't. - Try the agent's own undo. Claude Code's
/rewindand Cursor's checkpoints can undo edits the agent made in that session. Claude Code's documentation says plainly that changes made by shell commands aren't covered.
If none of that brings the files back, they're gone. The useful thing to do next is to make sure the next mistake can be undone.
What an AI safety net has to do
Plenty of tools can copy files. A safety net for AI agents has a harder job, and we think it has to pass six tests:
- The agent can't reach it. A history kept in files your account owns, such as a Git repository or a backup folder in your home folder, can be deleted by anything running as you. That includes the agent, in the same command that deleted the originals.
- It works with every agent. Agents change every few months. Protection tied to one of them, or to how it reports its own actions, misses the rest, and misses scripts and apps too.
- It's close to continuous. An hourly backup can be up to an hour old when the agent starts. You want the state from moments before.
- It notices. A mass deletion shouldn't wait for you to stumble on an empty folder.
- It restores in one step, and the restore itself can be undone.
- It's honest about its limits. Something that lives on your Mac can't replace a backup, and shouldn't pretend to.
That's the standard we built Safety Net to meet.
How VaultSort Safety Net works
You choose what to protect
Nothing is protected until you choose a folder. Safety Net runs on Mac and works through VaultSort's privileged helper, a small system component that the Safety Net page offers to install the first time you open it. The free version protects one folder and includes burst alerts. Premium protects as many folders as you like.
It keeps a history as files change
Safety Net watches your protected folders and keeps earlier versions of the files that are changed or deleted there, for 30 days. It doesn't wait for a schedule: the history follows changes as they happen.
The history is out of an agent's reach
This is the difference that matters most. Safety Net's history isn't kept in your home folder or owned by your account. It's kept in a store on your Mac's internal disk that belongs to the system (root), and only VaultSort's privileged helper writes to it. An app, script or AI agent running as you, which is how AI agents run, can't read, change or delete it. A recursive delete of your entire home folder doesn't touch it.
Turning Safety Net off for a folder asks for your Mac password, so an agent can't quietly switch it off before doing damage.
It notices bulk deletes and rewrites
Safety Net watches for the shape of a mistake. More than 200 files deleted or changed within 60 seconds in a protected folder counts as a burst. When one happens, Safety Net offers to restore the folder to how it was just before:
- with a notification, if notifications are on;
- in the app, if they're off;
- and if VaultSort isn't running, it opens on its own to make the offer.
In our tests, the offer appeared within 2 to 12 seconds of the burst.
One click puts the folder back
A restore puts the whole folder back in place. Files that were deleted or changed return as they were, and files created since are kept, so restoring doesn't throw away new work. Before restoring, Safety Net saves a "Before a restore" point of how things are now, so a restore can be undone too.
Restores take seconds. In our tests, 300 files came back in under 3 seconds, and a folder of 550 files deleted outright with rm -rf came back in a few seconds. In engine tests, larger folders took about 6 seconds per 10,000 files.
Restore points
Besides the point saved just before a burst and the one saved before a restore, Safety Net saves a restore point before an AI app connected through VaultSort's AI Connections first changes a protected folder. Those AI apps can also save a restore point themselves before risky work (kept for 3 days), and ask you to restore one. The restore itself is always your decision.
Restoring is always free. Anything in the history can be restored without Premium.
Erasing history on purpose
A history of deleted files is the opposite of what you want when you delete something on purpose. When you use VaultSort's Secure Delete or Encrypt on a file in a protected folder, VaultSort asks whether to erase its history too.
What Safety Net doesn't do
An honest list, because a safety net you misunderstand is worse than none.
- It isn't a backup. The history lives on the same disk as your files. If the disk fails, or the Mac is lost or stolen, the history goes with it. Keep Time Machine or another backup as well. (Against theft, what protects your files is FileVault and encryption such as VaultSort's Vault.)
- History goes back 30 days. Older versions are removed after that.
- It protects folders on your Mac's internal disk. Folders on external drives can't be protected.
- It can't stop anything running as an administrator. A process run with
sudoor as root is out of scope. If an agent asks for your Mac password, that's the moment to say no. - It counts changes; it doesn't read them. A burst is a count of deletes and rewrites. Safety Net doesn't inspect file contents, so a slow trickle of changes below the burst threshold won't raise an alert, though the history still has the earlier versions.
- Very short-lived files can be missed. A file created and deleted within a few seconds may never have been recorded.
- It's Mac only.
How it compares
Safety Net doesn't replace the tools you may already use. It covers a different failure.
| Where the history lives | What it covers | |
|---|---|---|
| VaultSort Safety Net | A system-owned store on the Mac's internal disk, out of reach of apps running as you | Changes by any app, agent or script running as you in the folders you protect, with an offer to restore after bulk changes |
| Time Machine | A separate backup disk | Everything it backs up, hourly by default |
| CoworkRestore | A Git repository on your Mac, inside or outside the project folder | Folders it watches, whichever tool changes them, plus before-and-after snapshots of Claude Cowork tasks |
| An agent's own undo (Claude Code checkpoints, ccundo) | The agent's session data | That agent's file edits, not its shell commands |
- Time Machine is a real backup and protects against what Safety Net can't: a dead or stolen disk. It backs up hourly by default to a separate disk. It isn't designed to tell you when hundreds of files vanish at once. Use both.
- CoworkRestore keeps a local version history of folders that AI tools edit, in a standard Git repository you can browse with any Git tool, and its restores can be undone. It runs on Apple silicon Macs with macOS 13 or later, takes before-and-after snapshots of Claude Cowork tasks, watches folders for other agents, and is free for one project, with one-time purchases beyond that (pricing).
- Agent undo tools are quick for undoing an agent's edits within a session. Claude Code's checkpoints and ccundo both say plainly that shell commands can't be undone this way.
Let AI help, and keep a way back
The point of Safety Net isn't to keep AI away from your files. It's to make saying yes less risky.
If you want an AI app to organize your files, there is a narrower door than giving it the shell. VaultSort's AI Connections let Claude Desktop, Claude Code and Cursor work only in the folders you choose. Every plan is checked and can be undone, nothing is deleted permanently, and you approve large changes. Safety Net covers everything else an agent does with its own tools. One makes the safe path easy; the other catches what happens off it.
Frequently asked questions
Can Claude Cowork delete my files?
Yes. When you give Claude Cowork a folder to work in, it can change and delete files there, including with terminal commands that skip the Trash. That's what happened in the 15,000-photo case above. Keep anything irreplaceable backed up, and protected with Safety Net, before handing it to any agent.
Is Claude Cowork safe to use?
Most sessions go fine, and it can do a lot of useful work. The risk is in broad instructions ("clean this up") on folders full of things you can't replace. Be specific, start with a copy or a narrow folder, keep a backup, and protect the folder with Safety Net so a mistake can be undone.
Codex or Claude Code ran rm -rf. Can I get my files back?
Not from the Trash, because rm doesn't use it, and not from the agent's own undo, which doesn't cover shell commands. Your options are a backup, your cloud service's deleted files, Git for committed code, or Safety Net if the folder was protected beforehand. Recovery software rarely helps on a Mac's SSD.
Does Safety Net work with Claude Code, Codex and Cursor?
Yes. Safety Net watches folders, not agents, so it doesn't matter which app made the change. It also catches your own mistakes, a script gone wrong, and a sync client copying a deletion from another computer.
Does Safety Net protect against ransomware?
Ransomware running as you rewrites files in bulk, and a rewrite of more than 200 files within a minute is a burst, so Safety Net offers to restore the folder from before it started. Safety Net counts changes rather than looking for encryption itself, so ransomware that works slowly may not trigger an alert. It can't protect against ransomware that has gained administrator rights, and it isn't an offline backup. Keep one of those too.
How much disk space does Safety Net use?
It holds earlier versions of files that were changed or deleted in your protected folders, for 30 days. There's no size cap, so a folder that changes a lot holds more. VaultSort shows an "up to" figure for the space the history may be using.
Is Safety Net a backup?
No. It lives on the same disk as your files, so it protects against mistakes, not against losing the disk. Use it alongside Time Machine or another backup.
