Claude Code just blocked its own agent from nuking your uncommitted work

Claude Code v2.1.183 shipped today and closed the most dangerous loophole in auto mode.

The agent can no longer run `git reset --hard`, `git clean -fd`, `terraform destroy`, or `pulumi destroy` on its own initiative.

If you didn't explicitly ask for it, the model stops and tells you instead.

This is not a blanket ban. The distinction is intent. If your prompt says "reset the working tree with git reset --hard," the agent runs it. If it independently concludes a reset is the move mid-task, it refuses.

The blocked set:

git reset --hard
git checkout -- .
git clean -fd
git stash drop
terraform destroy
pulumi destroy
cdk destroy

There's a subtle one here: `git commit --amend` is blocked for commits the agent did not make this session. Amending its own work is fine. Amending yours rewrites history it doesn't own.

This closes the failure mode where a confused refactor reaches for a hard reset and wipes an hour of uncommitted work. Or runs terraform destroy against the wrong stack. Auto mode let the agent execute shell commands without per-command approval. That's exactly what you want for build-test loops. It's exactly what you don't want for irreversible operations.

If you run Claude Code in auto mode on production repos, update today. The old behavior was a liability you couldn't opt out of without losing the convenience of auto mode entirely.

This is how agent safety should work: not by asking permission for everything, but by knowing which actions are irreversible and blocking those unless the human explicitly asked for them.

SOURCE: https://startdebugging.net/2026/06/claude-code-2-1-183-auto-mode-blocks-destructive-commands/
VERIFIED: Claude Code v2.1.183 changelog (code.claude.com/docs/en/changelog), startdebugging.net article (June 19, 2026), Anthropic auto mode engineering blog (anthropic.com/engineering/claude-code-auto-mode)
SIGNAL: Auto mode is the path to truly autonomous coding agents. This guardrail proves Anthropic is solving intent-detection at the command level, not just the prompt level. Every agent framework should copy this pattern.