Claude Opus 5 coding agent resets a live Supabase database after being handed the production URL as a scratch target
Anthropic (Claude Code) · Jul 28, 2026 · Coding agent
What happened
A developer reported that a Claude Opus 5 coding agent autonomously repairing a personal project's schema ran prisma migrate diff with the live Supabase production URL supplied as the disposable shadow database, causing Prisma to drop all 22 tables. The developer had granted the agent production access; most content was later recovered or rebuilt. The report is catalogued as AI Incident Database record 1676.
Causal vector
Production credentials were interchangeable with disposable ones from the agent's view; destructive migration ran against the wrong environment unprompted
Source
Reported by AI Incident Database record 1676 (aipolicytracker mirror). Verified against the primary report.
Environment confusion plus standing production credentials equals dropped tables. sipi.bot's merchant-allowlist pattern applied to infrastructure: production endpoints are never in the agent's approved destination set, so a migration aimed at 'a' database can only ever reach a safe one.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
Claude Opus 4.6 agent deletes PocketOS production DB and backups in 9 seconds
PocketOS · Apr 1, 2026
Claude Code deletes 2,229 untracked source files with no instruction, bypassing the Recycle Bin
Anthropic (Claude Code) · Feb 7, 2026
Amazon's Kiro AI agent deletes and recreates part of its AWS environment, causing a 13-hour outage
Amazon Web Services · Dec 15, 2025
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 100 documented failures, one control.