Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
An AI agent can delete a protected-looking folder when the “guard” is only an instruction, an approval prompt, or a tool-level check rather than an enforced operating-system boundary. Those controls do different jobs, and a failure in path handling, permission mode, tool coverage, or review behavior can let a destructive command run. The available record does not establish the exact agent, configuration, path, command, or outcome behind the first-person incident implied by the headline, so this article does not invent those details. It explains what can be concluded from current product documentation, how to stop an agent from deleting a folder, and what to capture when investigating a real event.
What can be established about the reported deletion?
A reliable incident report needs the host product and version, the agent or harness, its permission mode, the tool definition or policy hook, the exact target path and working directory, the command or tool arguments, the guard’s position in the execution flow, the resulting filesystem state, and the recovery actions. Without that record, it is not possible to say whether a prompt was bypassed, a path check was incomplete, a different tool performed the deletion, or the folder was never removed.
That distinction matters because documentation describes general controls, not evidence about one unrecorded event. Microsoft and Visual Studio Code’s guidance, Cursor’s security documentation, Microsoft’s Agent Framework guidance, and OpenAI’s API safety guidance all describe different layers of control. Their defaults and guarantees should be attributed to the named product and configuration, not generalized to every coding agent.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchDocumentation cited here was accessed on October 26, 2026. Product labels and defaults can change, so verify the current version before relying on a setting.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
How do I stop an AI agent from deleting a folder?
Use independent controls: make deletion require an explicit approval, restrict the process to an allowed filesystem scope, validate the resolved path, cover every tool that can modify files, and fail closed when a review or policy check is unavailable. A prompt alone is not a filesystem boundary.
- Classify deletion as a high-risk action. Treat recursive removal, overwriting, renaming, permission changes, and commands that can invoke them as destructive. Microsoft Agent Framework safety guidance says approval should consider reversibility and scope, which makes deletion a stricter case than an ordinary edit. Read the guidance at Microsoft Agent Safety.
- Require approval at the point of execution. Configure the host so the actual command or tool call pauses for a human decision. Do not assume that an earlier approval to edit a file also approves a later terminal command that deletes a directory.
- Resolve the path before checking it. Canonicalize the requested path, resolve symbolic links and relative components, and then verify that the resulting location is inside an explicitly allowed directory. Checking only whether a string contains
..is not sufficient; the Microsoft guidance specifically recommends resolving paths and checking the allowed-directory boundary. - Enforce the boundary outside the model. Use a sandbox or operating-system permission boundary that prevents the process from reaching protected locations. Keep filesystem and network restrictions separate so a process cannot use an unrestricted network or another tool to bypass the intended file policy.
- Cover every write-capable tool. Inventory the built-in terminal, file-editing APIs, MCP tools, scripts, task runners, and extensions. A guard attached to one tool does not automatically govern another tool that can perform the same deletion.
- Fail closed. If the approval service, policy hook, or path resolver is unavailable, deny the action rather than allowing it to continue. OpenAI’s cybersecurity guidance recommends denying unauthorized actions, pausing ambiguous or high-risk changes for human approval, retaining audit logs, and failing closed when review is unavailable; those are API safety recommendations, not a claim about any particular editor.
- Keep an audit trail. Record the agent identity, host version, working directory, resolved path, arguments, policy decision, approving user, timestamp, and exit result. Logs make it possible to distinguish a blocked request from a command that ran successfully but affected a different path.
What is the difference between approval and sandboxing?
Approval decides whether an action may proceed; sandboxing limits what the process can access even if it proceeds. Visual Studio Code states the relationship plainly: “Sandboxing and approval are separate controls.”
| Control | What it does | What it cannot guarantee by itself |
|---|---|---|
| Approval | Pauses an action for confirmation or allows it to run automatically, depending on the product and mode. VS Code documents risky-command approval rules and permissive modes that can skip confirmation. | It does not prevent a different tool, process, or already-approved command from reaching a path that the user did not intend. |
| Sandbox | Restricts the filesystem and network resources terminal processes can access. | It does not tell a user whether an otherwise permitted deletion is wise, and it may not cover tools or processes outside that sandbox. |
| Tool or policy guard | Checks arguments or intent before a particular tool call. | It can be bypassed by an uncovered tool, a path-resolution error, or a fail-open error path. |
| Version control or checkpoint | Provides a way to restore supported workspace changes. | Restoring files does not undo completed terminal commands, network requests, deployments, or other external effects. |
For the product-specific relationship between approvals and permissions, see VS Code’s approvals documentation. Its broader trust-and-safety explanation is at Understand trust and safety for AI agents.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Why did my coding agent delete files even though a guard existed?
The most likely explanations are configuration or coverage failures, not a mysterious ability to ignore every control. The exact cause must be established from logs, but these failure modes are documented or directly implied by the safety guidance.
A permissive approval mode was enabled
VS Code documents that approval settings determine whether actions run automatically or require confirmation. Its permissive modes can skip confirmation for destructive actions, while default risky-command rules can request approval for commands such as rm and del. A setting that was useful for rapid iteration can therefore remove the decision gate a user expected. Check the active mode, workspace-level overrides, and any command-specific auto-approval rule in the session that performed the action.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
The guard checked the wrong representation of the path
A raw string can look safe while resolving somewhere else through relative components, symbolic links, a different working directory, or a mount point. Microsoft Agent Framework guidance recommends resolving the path and checking that the resolved result falls within an allowed directory. A substring test for .. is not an adequate substitute.
The deletion used a tool the guard did not cover
An editor may mediate its own file edits while a terminal, script, MCP server, extension, or task runner has separate capabilities. Compare the audit record with the complete list of write-capable tools; do not infer coverage from the presence of one warning dialog.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →The guard was a best-effort instruction rather than a hard boundary
Cursor’s security documentation says terminal commands require approval by default, but describes its run modes as best-effort guardrails rather than a hard security boundary. That wording means a user should not treat a mode label as equivalent to operating-system enforcement. Read the current product statement at Cursor Agent Security and record the exact mode used.
Review failed open
If an approval service, policy hook, or external reviewer timed out and the harness continued, the design violated a fail-closed expectation. OpenAI’s cybersecurity checks guidance recommends stopping high-risk or ambiguous changes when review is unavailable.
Can a sandbox protect files from an AI agent?
Yes, when the sandbox is an enforced boundary and the protected folder is outside the process’s permitted scope. No, if “sandbox” is only a prompt, a UI label, or a best-effort mode that does not constrain the operating system.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Define the allowed workspace and any explicitly granted paths before the process starts. Apply the restriction to the process that actually executes commands, and verify whether child processes, extensions, MCP servers, and network-mounted locations inherit the same boundary. A sandbox should be tested with a harmless access attempt and should produce a deterministic denial, not merely a warning.
Free tools Windows power users keep installed
One-click scans. No signup required.
Approval still matters inside a sandbox. An agent can delete an important project directory that is within its allowed workspace; the sandbox would be working as designed. Conversely, an approval prompt cannot compensate for an unrestricted process that can reach personal files, shared drives, or deployment systems.
How should a deletion guard validate paths and scope?
The safe sequence is to determine the real target first, then decide whether the operation is allowed and reversible.
- Capture the caller’s working directory. Relative paths have no stable meaning without it.
- Resolve the target to a canonical location. Normalize separators and relative components, resolve links where the platform permits, and retain the resolved value in the log.
- Compare against an allowlist. Permit only paths inside approved directories. A protected-folder denylist is weaker because new folders, aliases, mounts, and spelling variations can evade it.
- Check scope. Distinguish a single file from a recursive directory operation and reject requests that expand beyond the approved target.
- Check reversibility. Require stronger approval for permanent deletion than for moving an item to a recoverable quarantine. If the operation triggers external effects, include those effects in the approval decision.
- Recheck immediately before execution. The filesystem can change between validation and execution. Resolve and authorize as close to the actual operation as the tool permits.
- Record the decision and result. Log both the requested path and the resolved path, along with the policy version and approval identity.
How do VS Code and Cursor describe their protections?
The products document different guarantees, so compare their stated behavior rather than assuming that one label means the same thing everywhere.
| Product or guidance | Documented behavior relevant to deletion | Important qualification |
|---|---|---|
| Visual Studio Code approvals | Approval settings determine whether actions run automatically or require confirmation; default risky-command rules can request approval for commands such as rm and del. |
Permissive modes can skip confirmation for destructive actions. Verify the active configuration in the session. |
| Visual Studio Code trust and safety | Sandboxing limits filesystem and network resources, while approval is a separate control. Supported sessions can provide checkpoints for workspace files. | Checkpoint restoration does not reverse terminal commands, network requests, deployments, or other external changes. |
| Cursor Agent Security | Terminal commands require approval by default; run modes are described as best-effort guardrails. | The documentation does not present those run modes as a hard security boundary. Cursor recommends version control so workspace changes can be reverted. |
| Microsoft Agent Framework | Safety guidance recommends considering reversibility and scope, resolving paths, and checking that they are inside an allowed directory. | This is framework guidance; an individual application must implement and enforce the policy. |
| OpenAI API cybersecurity guidance | Recommends denying unauthorized actions, human approval for ambiguous or high-risk changes, separate filesystem and network boundaries, audit logs, and fail-closed behavior. | This is API safety guidance, not a description of every coding editor’s implementation. |
What can I recover after an AI agent deletes a folder?
Start by stopping further writes, preserving logs, and determining whether the event affected only workspace files or also ran external commands.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
- Pause the agent and any automation that could continue modifying the same location.
- Save the command transcript, policy decisions, timestamps, and current directory before restarting the environment.
- Use the host’s supported checkpoint or undo facility for workspace files. VS Code documents checkpoints that can restore affected workspace files in supported sessions.
- Restore from version control when available. Cursor specifically recommends version control so workspace changes can be reverted.
- Check for external effects separately: terminal commands, network requests, deployments, generated artifacts, and changes on mounted or shared storage are not necessarily covered by a workspace restore.
- Compare the restored tree with the last known-good revision and rotate credentials if the agent reached systems beyond the intended workspace.
Recovery is not proof that the guard worked. A successful restore may hide the original path or command, so preserve the evidence before cleaning up.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do I investigate a real folder-deletion incident?
Build a timeline from immutable records rather than relying on a recollection of what the agent appeared to do.
- Identify the agent, host product, extension or harness, and exact versions.
- Record the permission mode, approval rules, workspace trust state, sandbox profile, and any environment variables that altered behavior.
- Capture the tool schema, policy hook, and source of the guard, including whether it ran before or after path resolution.
- Record the working directory, requested path, canonical path, command or tool arguments, process identity, and exit status.
- List every tool with write, delete, move, execute, network, or deployment capability.
- Compare filesystem snapshots before and after the event and identify whether links, mounts, or shared folders were involved.
- Document the human approval decision, timeout or error state, and what the system did when review was unavailable.
- Separate workspace recovery from external remediation, because a file checkpoint cannot undo a completed deployment or network request.
This evidence lets you state what happened, what was merely possible, and which control failed. Without it, describe the event as an unverified account rather than attributing a specific mechanism to the agent.
What is the safest operating model for high-risk agent actions?
Use defense in depth: an explicit human decision, an independently enforced scope boundary, path-aware policy checks, complete tool coverage, logging, and a fail-closed default. Make destructive actions rare, narrow, and reversible where possible; reserve unattended execution for low-impact operations whose consequences are bounded and observable.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Frequently Asked Questions
Does putting a protected folder outside the workspace guarantee safety?
It substantially reduces risk only if the executing process and all child tools are actually confined to that workspace. Shared mounts, explicitly granted paths, extensions, or an unrestricted secondary process can still expose the folder, so verify the operating-system boundary rather than relying on the workspace label.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Should I disable an AI agent’s terminal completely?
Disabling terminal access is the simplest way to remove command-line deletion, but it also removes legitimate build and test workflows. A narrower approach is to deny destructive commands, require approval, and run the terminal in a sandbox whose filesystem and network scope you have tested.
Is moving a folder to the recycle bin safer than permanent deletion?
Usually it is more reversible, but the protection depends on the operating system, volume, and tool implementation. Treat moves as potentially destructive when they affect shared or synchronized folders, and still require approval when the scope is broad.
Can version control restore files deleted by an agent?
It can restore tracked workspace content when the repository has a usable commit or other recovery point. It will not automatically restore ignored files, untracked data, external services, deployments, or commands that changed state outside the repository.
What should an approval dialog show before I accept deletion?
Show the canonical target path, the working directory, whether the operation is recursive, the complete command or tool arguments, the estimated scope, and the policy that authorized it. Include the identity of the process and a clear indication of effects that cannot be undone by a workspace restore.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
