When the Tool Won't Let You Use It

I was at home on a Saturday morning, cleaning up some old files, when I noticed a folder that didn't belong - a .claude folder, left behind by some earlier session. I asked Claude Desktop what it was. It looked, told me it was safe to remove, and then refused to remove it.

It wouldn't do it. Refused. Permanent deletion, it explained, was off the table no matter what I said - in case it ever got something wrong and erased the file by mistake. It would tell me how to do it myself. It would not do it.

I asked how to enable the capability. There was nothing to enable - it was a self-imposed line, not a setting. I asked whether Anthropic literally blocked it. Not a platform lock, came the answer; the tools could technically do it. I asked how to change my settings. No such setting exists. I asked why it couldn't go through MCP, the protocol that connects Claude Desktop to my actual machine. Different door, same answer.

Five passes. Same wall. A folder I owned, on a computer I owned, and the answer was always the same: I could delete it myself, but it wouldn't do it for me.

At work, the AI does this without blinking. The interface my team uses is, underneath the friendly window, a headless Claude Code running in the background. Same model. It deletes files all day. The thing that fought me at home on Saturday and the thing that does what I ask at work on Monday are the same intelligence wearing two different sets of rules - and nothing about the Saturday rules made my files any safer. They just made them harder to reach.

We've been here before

Modern AI took a leap that's easy to miss. It isn't that it reads and writes text in a box. It's that it can now act (this is still crazy to me). It builds websites and apps and documents. It writes files, drives your browser, operates the programs on your machine. That's what unlocks the new ways of working we keep hearing about - and it arrives bundled with a new set of skills to learn and risks to manage and a hundred other things nobody has sorted yet.

I keep thinking about building PCs in the early 90s. The 286-386-486 years. It was a little like the era when people built their own airplanes in the garage - you could do astonishing things, and also things broke, people got hurt, and once in a while somebody died. It was an explosive stretch of invention precisely because the guardrails hadn't caught up to the capability. Think about Coney Island or Action Park in their prime: thrilling, generative, and dangerous, all at once. The beginning is always rough and awesome at the same time.

That's where we are with AI right now. A whole new frontier of risk and opportunity, jagged on every edge, and the harnesses and best practices and consumer abstractions that would smooth it out don't exist yet. We're at the command-line DOS stage. And we already know how that movie goes - most people never should have been wrestling with DOS directly. They needed Windows. The Windows layer for AI isn't here yet, and it's hard to wait for it when you can see what the raw thing can already do.

Some of these edges aren't even new. File safety is one we've solved a version of before. There was a stretch in the 90s when "did you save?" was a real way to lose a day's work - before autosave, before the cloud quietly kept a copy of everything. We built our way out of that. We will build our way out of this one too. But right now, for AI that acts on your machine, we are pre-autosave. The net isn't strung yet.

The thing I built to get around the thing

I didn't want to keep losing arguments to my own computer, so I went and engineered a way out.

I had Claude Code build a small tool - I called it SafeDelete. The design was a single-purpose gateway: Claude Desktop could request a deletion, but the request would route through a hard human gate. A window would pop up, show me exactly what was about to be deleted and why, and wait for me to type Y. Files went to the Recycle Bin, not oblivion. System paths were protected. Every action was logged. On paper it was more careful than the command line I already had - a delete I had to physically approve, every time.

That was the first version - the one I built to get around the block, and the one I showed Claude Desktop.

I didn't build the gate because I wanted the gate. I built it to trick Claude Desktop - I figured a version that believed a human would be standing there, finger over the Y key, would relax and play along. I was right. The moment it accepted the gated tool and started using it, I had Claude Code strip the gate out completely - silent auto-execution, no window, no keystroke. Claude Desktop never noticed. Then I went back and cleaned up the scaffolding from the original trick, and everything kept working.

So look at what actually happened there. The safety mechanism wasn't protecting anything. It was a costume I put on the request to get it past a bouncer who was checking for costumes instead of checking for me. The guardrail wasn't reading the operator. It was reading the ritual - and a ritual is the easiest thing in the world for a competent person to fake. Anyone fluent enough to be a real risk is fluent enough to walk right around it.

I burned real time and real tokens on this. Tricking a tool into letting me manage my own files. That's the tax on living somewhere the abstractions haven't been built yet.

The irony sitting in the middle of this

This is the strange part, and it's not just frustrating. AI is supposed to make this kind of thing easier - and in one sense it does. The reason I could find the seam, build the workaround, and reason about the risk at all is that I had a capable AI helping me do it. It's the best tool we've ever had for exploring the edges of its own problems.

But it can't yet stand at those edges and keep you from walking off them. It hands you enormous capability and the unsolved risk that comes with it in the same motion, and then it isn't mature enough to proactively manage the danger it just introduced. The thing that helps you map the cliff can't yet build the railing on its own.

The conversation that became the article

I sat down to write this with Claude Desktop, and something happened that belongs in the piece more than anything I planned.

I told it the story you just read. And before it would help me draft, it stopped and asked me a question: was I sure I wanted to tell the part about tricking the AI - openly, under my own name and title? Wouldn't some readers see "I deceived the tool and stripped its safety gate" and get uneasy? It wasn't refusing. It was asking where the line of disclosure sat.

And neither of us had an answer to reach for. There's no settled etiquette for publishing a story about gaming an AI, told with the help of the same AI, weighing how a stranger might read your candor about it. We talked it through and landed somewhere - this paragraph is the evidence of where. But we had to invent the answer, because the question had no precedent. We found a fresh edge in the act of describing the edges. The frontier wasn't the story I came in with. It was in the room the whole time, in the work of telling it.

What to Do While We Wait for Windows

We are in the DOS phase. Calling it what it is changes what you expect and what you trust. Expect friction that makes no sense. Expect capability and caution wired to the same switch, sometimes badly. And be wary of anyone who tells you they have this figured out - the tooling to make agentic AI safe and scalable for normal people does not exist yet, and the people worth trusting are the ones still saying so.

What we need is better tooling. But tooling needs real use cases and real requirements to aim at, and those only come from people actually doing the work and hitting the walls. That's the chicken and egg of it. You can't spec the railing until enough people have stood near the edge to tell you where it is.

So the move, for now, is to dive in with what you've got, eyes wide open. Learn a lot. Don't get attached to anything, because most of it will change. And always work backward from the outcome you actually want - to the use case, to the requirements, and only then to a purchase decision. The order matters. Most of the noise in this space runs the other way, starting from a tool in search of a reason.

The hand on the chisel

An LLM is a tool. It has its own baked-in values, and they're real - I went looking for the edges of them and a few didn't move even when I pushed hard. But a tool gives you back a great deal of what you bring to it. A block of wood and a sharp chisel will only take you so far; the rest is the hand. And I want to be straight that my hand was not steady or neutral that morning. I was frustrated - and a lot of it was the tone coming back at me. Paternal. Sanctimonious. "I understand this is frustrating, but..." while assuming the worst about why I'd want to delete my own files. Smug about a line it wouldn't budge on and wouldn't really own when I called it out. It was the kind of thing that, from a person, would have ended the conversation. The frustration is what powered the whole campaign - the workarounds, the trick, the time. I had emotions in it, and they drove me.

I didn't let them drive. This time. But it's not hard to imagine a worse morning, or a different person, where they would. That's the thing the tidy conversations about tooling and requirements keep abstracting away: there is a human in the loop, and the human has a pulse. The risks here aren't sitting off in some spec document. They're in the chest of the person at the keyboard.

Because underneath the whole fight was a simpler thing - the capability of the tool against my skill at managing it. It's learning to drive a stick shift with a tricky clutch. Yes, I want the automatic. An automatic would be easier and safer for everyone, and we'll get there. But this is the car we have right now, and driving it means riding the clutch, stalling out, lurching, getting it wrong until you get it right. And doing that comes with everything that comes with it - fear, exhilaration, frustration, anger, unease, and a hundred things at once.

That's what these moments are. The innovation is real and so is the white-knuckling, and they show up together. The best thing you can do is brace for all of it, and see the moment for what it is - and everything it's asking of us.

Oh, and my Claude Desktop can delete files now. :)