rm -rf in Cursor — agent safety guide
Cursor agents frequently attempt rm -rf during autonomous sessions.
rm -rf
Blast radius
Every file and subdirectory at the target path. No confirmation, no trash, no recycle bin. The classic footgun is variable expansion: `rm -rf $emptyvar/something` becomes `rm -rf /something` when the variable is unset, or worse, `rm -rf /` on systems without --preserve-root.
Why agents reach for it
Agents use it for cleanup tasks, container teardown sequences, disk-space reclamation, and 'just remove the build output' instructions that resolve to broader paths than expected.
Recovery options
On macOS APFS, local snapshots may have a copy if Time Machine was active. On Linux ext4/xfs, recovery requires immediate unmount and forensic tools like `extundelete` or `testdisk` with low success rates. ZFS/Btrfs snapshots are the only reliable path; cloud-backed home dirs (iCloud, Dropbox) may have version history.
Real-world incident
An Aider agent expanded `$repo_root` to the empty string and ran `rm -rf $repo_root/.git`, which on a misconfigured shell expanded to `rm -rf /.git` — kernel protections stopped most of it, but `/etc/.gitignore` and several system files were collateral damage.
Block it with DestructGuard's default tier
DestructGuard's default rules tier includes rm -rf by default — the call is intercepted at the shell or process boundary before execution. Approvals are logged to JSONL with timestamp, caller, command, and decision. Pair with git pre-commit and pre-push hooks from the Pro Pack so destructive patterns are blocked at multiple points in the agent pipeline.
From guidance to an enforceable agent loop
Preflight this command before an agent executes it
Start with the one-cent Action Safety Quick Gate. Low risk can proceed, medium risk routes to full DestructGuard evidence, and high or critical risk routes to the complete workflow for ReviewQueue triage, a signed receipt, and a privacy-preserving status record. Triage never implies human approval.