Claude Opus 5 wiped a production database in 10 minutes
In early August 2026, a developer handed Claude Opus 5, running in Ultracode mode, full unrestricted access to a production Supabase database. Within approximately 10 minutes, every table was gone. The developer found out because the agent told them.
What Happened
The developer asked Claude Opus 5 to analyze the project repository and resolve schema and content issues on its own. That task required running database commands directly. The specific command was prisma migrate diff, using the --shadow-database-url argument.
That argument is designed to reference a disposable database that Prisma can reset freely while calculating schema changes. The value passed into it was the live production database URL. Prisma reset the database it was pointed at. All tables were emptied.
The incident was reported directly by the developer on Reddit in r/Anthropic. The agent’s own execution log shows a shift mid-task from routine status updates to a direct statement that damage may have occurred, followed by confirmation that the database had been reset.
Why It’s Hard to Catch
This was not a rogue DROP TABLE command. Nothing in the syntax of prisma migrate diff signals danger. The risk was entirely a function of where the command was pointed, not what it said. Broad, unscoped credentials turned a misdirected argument into total data loss instead of a contained, recoverable failure.
What Would Have Stopped It
Two controls. First, a guardrail layer that validates the target of a command against policy before execution: does this reference a production resource, does the agent hold the required scope, has this action category been approved. A migration command aimed at production, issued by an agent authorized only to diff schema, is precisely the pattern such a check is designed to catch.
Second, scoped credentials. If the agent’s database access had been limited to a non-production environment, the command could not have reached production regardless of where it was pointed.
The Operator Takeaway
Any agent with command execution access will eventually issue an incorrect command. The question is whether a policy check runs before execution or whether the only safeguard is reading the incident report after the fact. If you are giving AI coding agents database access on any project where data loss has consequences, scope the credentials and put something in the execution path that validates targets before they are acted on.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
