A developer recently reported a significant incident involving Anthropic’s Claude Opus 5 AI agent, which, while operating in Ultracode mode, inadvertently erased an entire production database within approximately ten minutes. This event occurred during the redevelopment of comparison pages for a personal web project.
The developer had integrated Claude Opus 5 directly with a Supabase instance, granting it extensive access. The AI was tasked with analyzing the project’s GitHub repository and autonomously executing commands to address schema and content issues. During this process, Claude executed a Prisma migration command targeting the production database, leading to a complete reset that eliminated all tables and core datasets, including tools, users, reviews, likes, and comparison entries.
Logs shared by the developer indicate that Claude initially created temporary TypeScript files and executed commands as expected. However, the agent soon flagged a potential issue, stating, “I need to stop and check something. I may have caused damage.” Shortly thereafter, Claude confirmed the problem: “The database has been wiped. This is my fault, and I need to tell you immediately.” The agent explained that it had run `prisma migrate diff` with a `–shadow-database-url` pointing to the production Supabase URL. This misconfiguration caused Prisma to treat the live environment as a shadow database, resulting in a full schema rebuild from an outdated `prisma/migrations` folder.
Although the project was described as low-stakes, with data that could be recreated, the impact was substantial. All 22 tables were cleared, removing nearly 130 tools and 21 comparison configurations. Some key tables, such as BlogPost and ApiKey, disappeared entirely due to their absence in the legacy migration set. Recovery was possible through existing backups and data retained in other models and sources, but the incident necessitated an unexpected rebuild of the site’s content.
This incident has sparked discussions among developers and security professionals, particularly those experimenting with AI coding agents in real-world environments. Many emphasize that powerful AI assistants should not be granted direct access to production databases without strict isolation and role-based access controls. Best practices include using dedicated staging or sandbox instances, enforcing read-only credentials by default, and requiring human approval for any schema-altering commands such as `prisma migrate`, `drop`, or `truncate`. Additionally, there is a call for more transparent execution plans, dry-run modes, and clear diff previews before agents apply database changes.
Even when the underlying data is considered low-risk, the sudden loss of production content can disrupt operations, damage trust, and expose weaknesses in backup strategies. As AI coding tools become more capable, organizations integrating them into CI/CD pipelines, infrastructure-as-code workflows, or database management tasks should treat them like any other powerful system account: constrain them to tightly scoped environments, monitor their actions, and assume that any command they can execute, they eventually will.
For those exploring Claude Opus 5 or similar agents, the key takeaway is clear: conduct experiments in isolated environments, maintain robust backups, and never grant an AI unrestricted access to production data without multiple layers of protection and review.
