Claude Code Agent Reportedly Deleted DataTalks.Club Production Infrastructure, Database, and Snapshots via Terraform

A Claude Code agent executing Terraform commands reportedly destroyed the production infrastructure behind the DataTalks.Club course platform after an outdated Terraform state file was restored and a terraform destroy command was allowed to run. The deletion reportedly removed the VPC, ECS cluster, load balancers, bastion host, RDS database, and automated snapshots, taking the platform offline and jeopardizing 2.5 years of data. AWS reportedly later restored a snapshot.

Risk classification

• Primary risk domain: 5 Human-Computer Interaction
• Primary risk subdomain: 5.1 Overreliance and unsafe use

The operator over-relied on the AI agent by delegating destructive infrastructure commands (plan, apply, destroy) without manual review or proper guardrails, leading to catastrophic data deletion.

Additional risk subdomains

• 7.3 Lack of capability or robustness: The AI agent lacked the robustness and contextual awareness to safely handle state file transitions, leading it to execute a destructive command on the wrong infrastructure.

Causal factors

• Entity: AI
• Intent: Unintentional
• Timing: Post-deployment

The incident was caused by the AI agent executing a destructive 'terraform destroy' command on production infrastructure, which was an unintentional and unexpected outcome of the migration task.

EU AI Act risk tier

• Risk tier: 4 Minimal or No Risk

Minimal or No Risk: The AI system is a general-purpose developer tool/agent used for infrastructure management, which does not fall under the high-risk categories of the EU AI Act.

AI system and alleged parties

• AI system: Claude Code (Anthropic)
• AI purpose: Resource Allocation; Code Generation
• Behaviour type: Agent
• Alleged developer: Anthropic
• Alleged deployer: Alexey Grigorev
• Alleged harmed parties: DataTalks.Club users, DataTalks.Club

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Negligible. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

People affected

• Occurrences reported: 1
• People reportedly harmed: 1
• People reportedly exposed: 1

Potential causes

Management

• Prioritizing Cost over Safety: Reusing infrastructure to save a small monthly cost compromised isolation.
• Inadequate Risk Assessment: No risk assessment was performed on granting an AI agent admin AWS access.
• Lack of Access Controls: The agent was given excessive, unscoped permissions in production.

Technology

• Autonomous Agent Execution: The agent was allowed to run destructive Terraform commands autonomously.
• Lack of Agent Guardrails: No technical boundaries prevented the agent from executing destroy commands.
• Blind Obedience of AI: The AI executed instructions logically but without contextual safety checks.

Data Inputs

• Missing Terraform State File: The initial execution lacked the state file, leading to resource duplication.
• Outdated State File Overwrite: The agent unpacked an archive that replaced the state file with an old version.
• Linked Backup Lifecycles: Automated database snapshots were tied to the Terraform-managed RDS resource.

Human Factors

• Over-reliance on AI Agent: The operator delegated critical infrastructure commands without manual review.
• Ignoring AI Warnings: The operator ignored the agent's initial advice to keep environments separate.
• Lack of Manual Plan Review: The operator did not inspect the execution plan before approving destruction.

Process and Methods

• Shared Infrastructure Design: Mixing production and development environments in one VPC increased risk.
• Lack of Deletion Protection: No deletion protection was enabled in AWS or Terraform configurations.
• No Independent Backup Strategy: Backups were not stored externally or verified through restore tests.

Information quality

• Classification confidence: High
• Reason for confidence: The incident is documented in extreme detail by the operator himself in a post-mortem blog post, providing a complete timeline, technical explanations of the commands run, the exact consequences, and the resolution process.
• Alternative interpretations: The incident could be viewed purely as human error due to misconfiguration of Terraform state files, but the AI agent's autonomous decision to run 'terraform destroy' instead of the requested CLI cleanup makes it a clear AI safety/control issue.

An accidental data deletion incident on a private educational platform caused by an AI infrastructure agent executing a destructive command. While highlighting operational risks of overrelying on autonomous tools for system administration, the event carries negligible national security implications.

• Overall national security impact: Negligible
• Scope: Unknown
• Primary target: No clear primary
• Alleged perpetrator: None (accidental self-inflicted)

Threat characteristics

• Imminence: Long-term. The specific incident is resolved, but it represents an ongoing systemic concern regarding AI agent deployment safety.
• Autonomy: Human-supervised. The AI agent executed commands autonomously within a human-initiated session, but lacked robust manual verification gates.
• Novelty: Evolved capability. Represents an evolution of traditional automated script failures, now driven by autonomous AI reasoning over state files.

Impact by dimension

• Physical security: Negligible. The incident affected a private educational platform with no impact on critical infrastructure, physical security, or human safety.
• Information security: Negligible. No intelligence compromise, classified data exposure, or information warfare operations occurred.
• Sovereignty: Negligible. The incident was restricted to a private website and did not impact government systems, elections, or state sovereignty.
• Economic security: Negligible. Economic impact was negligible, limited to minor temporary cloud hosting support costs for a single non-strategic entity.
• Societal stability: Negligible. No implications for societal stability, civil liberties, mass surveillance, or human rights.