"It can read my files and run commands" is exactly the sentence that should make you ask this question — and the honest answer isn't "yes, don't worry about it." It's "yes, because of a specific mechanism, and here's what that mechanism does and doesn't cover."
Read-only exploration happens without asking. File edits and shell commands — anything that actually changes something — require your review first: a plain-English description of what's about to happen, before it happens. That's not a vague reassurance, it's a concrete gate every meaningful action passes through by default.
Unapproved actions. Nothing gets written, deleted, or executed that you haven't seen described first. This is the thing most "is it safe" worry is actually about, and it's a real, working mechanism — not marketing language.
You approving something you didn't actually read. This is the honest gap: after a dozen routine approvals in a row, it's easy to click yes on reflex. The mechanism gives you the information; reading it is still on you. This is also exactly why starting with small, easy-to-verify tasks matters — small changes are easy to actually evaluate, not just approve.
The same judgment you'd apply to any change to a live system still applies here: prefer a branch over committing straight to main, and give anything touching real user data or payments a slower, more deliberate look rather than the default quick review.
The free guide covers exactly what's pre-approved, what needs review, and a first real workflow to practice on.
Get the Free Guide →File edits and shell commands require your review by default — nothing destructive happens without you seeing a plain-English description first, unless you've pre-approved a broader scope yourself.
Approving something you didn't really read. The permission model stops unapproved actions; it doesn't stop you from rubber-stamping a change because the last ten approvals went fine.
With the same care you'd use for any change to production — review carefully, prefer a branch over committing straight to main, and treat anything touching real user data or payments with extra scrutiny.
Data handling is governed by Anthropic's actual terms and privacy policy, which vary by plan (Consumer vs. Commercial Terms) — check the current published terms directly rather than relying on a general claim here, since specifics matter and can change.