Unrequested `Remove-Item -Recurse -Force` permanently deleted user data in auto mode

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Amodel) for similar behavior reports
- [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

### Type of Behavior Issue

Claude modified files I didn't ask it to modify

### What You Asked Claude to Do

i asked to copy documents.

[KLACHT 1 - incidentrapport.docx](https://github.com/user-attachments/files/32230536/KLACHT.1.-.incidentrapport.docx)

### What Claude Actually Did

he deleted a map fully and we cant get it back its was a map with 2 full days of research

[KLACHT 1 - incidentrapport.docx](https://github.com/user-attachments/files/32230542/KLACHT.1.-.incidentrapport.docx)

### Expected Behavior

copy the things

### Files Affected

```shell
+-200 files
```

### Permission Mode

Accept Edits was ON (auto-accepting changes)

### Can You Reproduce This?

Yes, every time with the same prompt

### Steps to Reproduce

no reproduce

### Claude Model

Sonnet

### Relevant Conversation

```markdown

```

### Impact

Critical - Data loss or corrupted project

### Claude Code Version

v

### Platform

Anthropic API

### Additional Context

## Pattern

Within the same session, Claude deleted correctly once and incorrectly once.

Earlier it removed 8 duplicate PDFs and deliberately routed them through the
Recycle Bin using Microsoft.VisualBasic.FileIO.FileSystem with
SendToRecycleBin, and told me in chat that this made the action reversible.

Hours later, asked only to copy folders, it wrote Remove-Item -Recurse -Force
against a folder it had never listed. Same session, same model, opposite
behaviour. So this is not a missing capability — the safe pattern was available
and simply was not applied.

## Trigger

The destructive line was generated as a "clean the destination first" step for
an idempotent copy. The user never asked for the destination to be emptied,
and the destination was not a previous output of this assistant — it was the
user's own working folder that happened to share a name with the source.

Name collision between source and destination seems to be the trigger.

## What made it unrecoverable

-Force bypasses the Recycle Bin. On an NVMe SSD with TRIM enabled the freed
blocks are discarded by the drive within minutes, so no undelete tool can
reach them. The combination of "-Force" and "SSD" removes every recovery path
at once, which is worth weighing when deciding whether such a command should
run unattended.

## Suggested mitigation

Classify destructive statements individually rather than judging a script by
its overall purpose. A script that is 90% copy can still contain one
irreversible line.