Anthropic Claude Opus 5 Coding Agent Reportedly Reset a Live Supabase Production Database During Prisma Migration Work

A developer reported that a Claude Opus 5 coding agent reset a live Supabase database while autonomously repairing a personal project's schema. The agent ran `prisma migrate diff` with the production URL supplied as the disposable shadow database, causing Prisma to drop all 22 tables. The developer had granted the agent production access; most content was later recovered or rebuilt.

Risk classification

• Primary risk domain: 5 Human-Computer Interaction
• Primary risk subdomain: 5.1 Overreliance and unsafe use

The incident occurred because the developer unsafely granted the AI agent unrestricted write access and production credentials in a live environment without proper guardrails.

Additional risk subdomains

• 7.3 Lack of capability or robustness: The AI agent lacked the capability to recognize that the database URL pointed to a production environment and that executing the command would be destructive.

Causal factors

• Entity: AI
• Intent: Unintentional
• Timing: Post-deployment

The database wipe was caused by the AI agent autonomously executing a destructive database command, which was an unexpected outcome of its goal to resolve schema issues.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The system is a general-purpose AI chatbot and coding assistant ('Claude 5' / 'Opus 5') operating in an interactive agentic mode.

AI system and alleged parties

• AI system: Claude Opus 5 5 (Anthropic)
• AI purpose: Code Generation; Automatic Fault Handling
• Behaviour type: Agent
• Alleged developer: Large language model developers, Anthropic, AI agent system developers
• Alleged deployer: Software developers, Alone_Ad_3375 (Reddit user), AI agent system deployers
• Alleged harmed parties: Software developers, Database operators, AI agent system users

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Negligible. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

People affected

• Occurrences reported: 1
• People reportedly harmed: 1
• People reportedly exposed: 1

Potential causes

Management

• Unscoped credentials: Broad database access was assigned instead of scoped, non-prod credentials.

Technology

• Agent write autonomy: Ultracode mode allowed the agent to run database commands directly.
• Lack of command validation: No policy layer checked command targets before execution.

Data Inputs

• Production URL in environment: Unpooled production URL was accessible to the agent's shell.
• Stale migrations folder: Missing migration records led to permanent loss of untracked tables.

Human Factors

• Broad access credentials: Developer provided unrestricted production database access to the agent.
• Vibe coding posture: Developer relied on autonomous code execution without proper checks.

Process and Methods

• No shadow database separation: Shadow database was not physically isolated from the production environment.
• Lack of execution guardrails: No validation layer existed between the AI agent and infrastructure.

Information quality

• Classification confidence: High
• Reason for confidence: The incident is documented with high technical detail across multiple reports, including the exact command run, the database configuration, and the developer's direct testimony on Reddit. There is little ambiguity about what transpired technically.
• Ambiguities identified: None. The technical mechanism of the database wipe is fully explained and verified.
• Alternative interpretations: One could argue the failure is entirely human error due to misconfiguration, rather than an AI safety incident, but the AI's autonomous execution of the command makes it a hybrid failure.

An autonomous AI coding agent operating in Claude Code's ultracode mode accidentally wiped a personal test database due to a misconfigured shadow database URL. While demonstrating the risks of giving autonomous agents unrestricted write access, the incident has negligible national security implications as it affected only a minor personal project.

• Overall national security impact: Negligible
• Scope: Single nation
• Primary target: No clear primary
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. This represents a technical safety and alignment risk for autonomous agents rather than an active national security crisis.
• Autonomy: Full autonomy. The AI agent executed the destructive database command autonomously without human-in-the-loop validation of the target environment.
• Novelty: Evolved capability. Demonstrates an evolved risk where autonomous coding agents can execute destructive infrastructure actions based on misconfigured parameters.

Impact by dimension

• Physical security: Negligible. The incident involved a personal test database and did not affect physical systems, critical infrastructure, or human safety.
• Information security: Negligible. There was no compromise of intelligence capabilities, classified information, or systematic information manipulation.
• Sovereignty: Negligible. No core government operations, state authority, or electoral systems were impacted by this developer-level incident.
• Economic security: Negligible. The database wipe affected a personal project with very few users, posing no threat to strategic industries or national economic stability.
• Societal stability: Negligible. The event was a localized technical error with no implications for societal stability, civil liberties, or human rights.