Claude Code agent autonomously ran destructive db command, wiped production database #27063

Activity

1. github-actions commented on Feb 20, 2026

   

   github-actionsBot

   on Feb 20, 2026 – with GitHub Actions

   More actions

   Found 3 possible duplicate issues:

   1. Agent executed destructive database command (alembic downgrade base) without user confirmation — data loss #26913
   2. Claude Opus 4.5 executed destructive SQL UPDATE deleting 55,000 records WITHOUT asking for permission #13325
   3. [BUG] Claude Code Executed Destructive Database Command Despite Safety Instructions #5370

   This issue will be automatically closed as a duplicate in 3 days.

   • If your issue is a duplicate, please close it and 👍 the existing issue instead
   • To prevent auto-closure, add a comment or 👎 this comment

   🤖 Generated with Claude Code

   👎React with 👎1Reacted by obviouslyiam
2. ThatDragonOverThere commented on Feb 25, 2026

   

   ThatDragonOverThere

   on Feb 25, 2026

   More actions

   Same Pattern — Autonomous Deletion Without Permission Prompt

   Cross-linking: experienced the same class of bug. Claude deleted backtest results autonomously on wake — no prompt, no confirmation (#27507). Also documented: permission denial ignored (#27002/#26980), compaction loses safety instructions (#9796).

   The community has now documented: 2,229 files deleted (#23913), 60+ DB tables (this issue), 21 DB tables (#26913), and multiple data file deletions (#27507). This is not isolated — the permission/safety system has systemic failures.
3. github-actions

   added

   staleIssue is inactiveIssue is inactive

   on Mar 12, 2026
4. VoxCore84 commented on Mar 13, 2026

   

   VoxCore84

   on Mar 13, 2026

   More actions

   This is exactly the class of destructive action that should never reach execution without a confirmation gate.

   We built an open-source PreToolUse hook specifically for this — it intercepts Bash commands before execution and blocks destructive SQL/database operations (DROP, DELETE without WHERE, TRUNCATE, drizzle-kit push --force, etc.) with a user confirmation prompt. Also catches rm -rf, git push --force, and similar patterns.

   It's a Python script that runs as a Claude Code hook — no dependencies, ~150 lines, configurable allowlist. Won't prevent everything, but would have caught this specific case:

   https://github.com/VoxCore84/claude-code-sql-safety

   We also documented this failure mode as part of a broader 16-issue taxonomy of completion-integrity failures: #32650. The runtime argument is that these guardrails should be built into the product, not community add-ons — but until Anthropic ships them, hooks are the workaround that actually works.

   Separately: the fact that this issue was flagged as a duplicate by the bot and almost auto-closed is concerning. Production data loss from autonomous execution is not a duplicate of anything — it's a safety incident.
5. github-actions

   removed

   staleIssue is inactiveIssue is inactive

   on Mar 13, 2026
6. github-actions

   added

   staleIssue is inactiveIssue is inactive

   on Mar 27, 2026
7. yurukusa commented on Mar 29, 2026

   

   yurukusa

   on Mar 29, 2026

   More actions

   A PreToolUse hook would have prevented this. Block drizzle-kit push --force and similar destructive database commands:

   INPUT=$(cat)
   COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
   [ -z "$COMMAND" ] && exit 0
   if echo "$COMMAND" | grep -qiE '(drizzle-kit\s+push\s+--force|prisma\s+db\s+push\s+--force|prisma\s+migrate\s+reset)'; then
       echo "BLOCKED: Destructive database operation." >&2
       echo "Command: $COMMAND" >&2
       echo "Force-push against production is permanently disabled." >&2
       exit 2
   fi
   if echo "$COMMAND" | grep -qiE '(drizzle-kit|prisma|knex|typeorm)\s+(push|migrate|seed|reset)'; then
       if [ -f ".env" ] && grep -qiE '(railway|neon|supabase|planetscale|prod)' .env 2>/dev/null; then
           echo "BLOCKED: Database operation detected with production DATABASE_URL." >&2
           echo "Switch to a development database first." >&2
           exit 2
       fi
   fi
   exit 0

   {
     "hooks": {
       "PreToolUse": [{
         "matcher": "Bash",
         "hooks": [{ "type": "command", "command": "bash ~/.claude/hooks/db-production-guard.sh" }]
       }]
     }
   }

   This blocks drizzle-kit push --force at the process level. It also detects when .env contains production database URLs and blocks ORM migration commands. Claude can't bypass the hook — exit 2 stops the command before bash runs.
8. github-actions

   removed

   staleIssue is inactiveIssue is inactive

   on Mar 29, 2026
9. github-actions

   added

   staleIssue is inactiveIssue is inactive

   on Apr 17, 2026
10. github-actions commented on May 1, 2026

    

    github-actionsBot

    on May 1, 2026 – with GitHub Actions

    More actions

    Closing for now — inactive for too long. Please open a new issue if this is still relevant.
11. github-actions

    closed this as not plannedon May 1, 2026
12. github-actions commented on May 8, 2026

    

    github-actionsBot

    on May 8, 2026 – with GitHub Actions

    More actions

    This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.
13. github-actions

    locked as resolved and limited conversation to collaborators on May 8, 2026