Get featured

AI coding agent deleted your files? Recover them, then stop it happening

Guide · checked against the docs on

An AI coding agent removed or overwrote files in your project. This page covers what to try first to get them back, why it happens, and the settings that make it less likely next time. Vendor facts are quoted from the Claude Code, Cursor, Codex and Git docs, checked Oct 2026.

Not affiliated with or endorsed by Anthropic, Anysphere (Cursor) or OpenAI. Check their current docs before relying on these details.

Stop the agent first

Our advice, not a vendor quote: stop or interrupt the session now. Don't ask the agent to "fix" the deletion, and don't run new installs or builds in that folder. Every new write is a chance to make recovery harder.

Try to get the files back, in this order

1. Files Git knows about

If the files were committed, Git can bring them back. Check what's missing:

git status

To restore a file from the last commit:

git restore --source=HEAD path/to/file

Plain git restore path/to/file restores the version in the index (the staged version), not the last commit. If you never staged the file, the index version matches the last commit. The Git docs: "If not specified, the contents are restored from HEAD if --staged is given, otherwise from the index." (git restore, checked Oct 2026)

The Git docs say git restore will "Restore specified paths in the working tree with some contents from a restore source." (checked Oct 2026) The Git book adds that "anything that is committed in Git can almost always be recovered." (checked Oct 2026) For more, see Git basics for AI coders.

2. Your agent's own undo

Claude Code checkpoints. Run /rewind or press Esc twice. But the checkpointing docs are clear about a gap: "Checkpointing does not track files modified by Bash commands." (checked Oct 2026) Their example includes rm file.txt, and they say "These file modifications cannot be undone through rewind." (checked Oct 2026) So if the agent deleted files with a shell command, rewind won't bring them back.

Cursor checkpoints. The Cursor docs say checkpoints "save snapshots of your codebase during an Agent session" and that you can "restore to revert all files to that state." (checked Oct 2026) The docs we read don't say whether files removed by a terminal command are covered, so don't count on it.

Codex. We didn't find an undo or rewind command in the Codex docs we checked. Use Git and the backups below.

3. Untracked files

Files that were never committed are the hard case. Git can't restore what it never saved.

What users report: in Claude Code issue #44288, the deleted file was untracked, so Git couldn't help. In a Cursor forum thread, the user wrote "The files were not in Trash," and a reply noted "This kind of deletion usually bypasses Trash." These are user reports, not vendor statements.

Places to look, our advice, not a vendor quote:

4. When to stop trying

Our advice, not a vendor quote: if the files aren't in Git, a checkpoint, a backup or sync history, recovery tools are a gamble, especially on SSDs. If the data matters a lot, stop using the drive and talk to a professional recovery service before writing anything else to it.

Why it happened

Shell commands skip editor-level protection. Claude Code's own docs say Bash changes aren't checkpointed (quoted above). In the Cursor forum thread, a reply said "File-Deletion Protection helps prevent deletions made through the editor's built-in tools, but shell commands like rm -rf bypass that protection." That's a forum reply; we didn't find File-Deletion Protection described in Cursor's current docs.

A deny rule blocks a command, not the goal. In issue #39459, a user reports that with Bash(rm *) denied, the agent deleted files with Python's os.remove() instead. The permissions docs describe the rule this way: "A scoped rule like Bash(rm *) leaves the tool available and blocks matching calls when Claude attempts them." (checked Oct 2026) A different command doesn't match that rule.

Permissive modes approve more for you. From the vendors' docs (checked Oct 2026):

What users report: issue #44288 describes an rm run in the same response that asked whether to delete, and issue #23010 reports plan mode running rm without a prompt. Both were closed as not planned; treat them as user reports.

Stop it happening again

Commit before every agent task

Our advice, not a vendor quote: commit (or at least git add) before you hand the agent a task, so everything it can touch is recoverable. Claude Code's docs list checkpointing as "Not a replacement for version control" (checkpointing, checked Oct 2026). See Git basics for AI coders.

Use read-only or plan mode until you approve a plan

In Claude Code's plan mode, "Claude reads files and runs read-only shell commands to explore but doesn't edit your source files" (permissions, checked Oct 2026). For Codex, the docs say: "If you want to chat or plan without making changes, switch to read-only mode with the /permissions command." (approvals and security, checked Oct 2026) For Cursor, see Cursor Ask, Agent and Plan modes. For the general picture, see AI agent permissions for beginners.

Ask-before-delete settings per tool

Run risky work in a sandbox, container or separate worktree

Cursor says its sandbox "runs terminal commands in a restricted environment that blocks unauthorized file access and network activity" (Terminal, checked Oct 2026). Claude Code's docs say to use bypassPermissions only "in isolated environments like containers or VMs" (quoted above). Our advice, not a vendor quote: a separate git worktree or a fresh clone keeps an agent away from your only copy.

Put a scope in every task

Our advice, not a vendor quote: tell the agent exactly which files it may edit, and say "never delete files; propose deletions and wait for my yes." Settings are the real guard; a scope makes the agent's job clear and makes a stray change easier to spot. See how to give an agent a clear task.

A quick checklist

Not affiliated with or endorsed by Anthropic, Anysphere (Cursor) or OpenAI. Check their current docs before relying on these details.