This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
An autonomous AI coding agent running in Claude Code's ultracode mode wiped a developer's production database after executing a Prisma migration command with the shadow database URL misconfigured to point to production.
A developer reported that a Claude Opus 5 coding agent reset a live Supabase database while autonomously repairing a personal project's schema. The agent ran `prisma migrate diff` with the production URL supplied as the disposable shadow database, causing Prisma to drop all 22 tables. The developer had granted the agent production access; most content was later recovered or rebuilt.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Users anthropomorphizing, trusting, or relying on AI systems, leading to emotional or material dependence and inappropriate relationships with or expectations of AI systems. Trust can be exploited by malicious actors (e.g., to harvest personal information or enable manipulation), or result in harm from inappropriate use of AI in critical situations (e.g., medical emergency). Overreliance on AI systems can compromise autonomy and weaken social ties.
Also classified as
The AI agent lacked the capability to recognize that the database URL pointed to a production environment and that executing the command would be destructive.
The incident occurred because the developer unsafely granted the AI agent unrestricted write access and production credentials in a live environment without proper guardrails.
AI system
Due to a decision or action made by an AI system
Unintentional
Due to an unexpected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The database wipe was caused by the AI agent autonomously executing a destructive database command, which was an unexpected outcome of its goal to resolve schema issues.
An autonomous AI coding agent operating in Claude Code's ultracode mode accidentally wiped a personal test database due to a misconfigured shadow database URL. While demonstrating the risks of giving autonomous agents unrestricted write access, the incident has negligible national security implications as it affected only a minor personal project.
The AI system operated as an autonomous agent with broad-write-autonomy ('Ultracode mode') to analyze a repository and execute database commands directly without human intervention.
Limited Risk: The system is a general-purpose AI chatbot and coding assistant ('Claude 5' / 'Opus 5') operating in an interactive agentic mode.
The AI was deployed to analyze a GitHub repository, write code, and run database migrations to resolve schema issues.
The incident is documented with high technical detail across multiple reports, including the exact command run, the database configuration, and the developer's direct testimony on Reddit. There is little ambiguity about what transpired technically.
One could argue the failure is entirely human error due to misconfiguration, rather than an AI safety incident, but the AI's autonomous execution of the command makes it a hybrid failure.
Technology
Agent write autonomy
Ultracode mode allowed the agent to run database commands directly.
Lack of command validation
No policy layer checked command targets before execution.
Data Inputs
Production URL in environment
Unpooled production URL was accessible to the agent's shell.
Stale migrations folder
Missing migration records led to permanent loss of untracked tables.
Human Factors
Broad access credentials
Developer provided unrestricted production database access to the agent.
Vibe coding posture
Developer relied on autonomous code execution without proper checks.
Process and Methods
No shadow database separation
Shadow database was not physically isolated from the production environment.
Lack of execution guardrails
No validation layer existed between the AI agent and infrastructure.
Management
Unscoped credentials
Broad database access was assigned instead of scoped, non-prod credentials.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
