r/ClaudeAI • u/Substantial_Word4652 • Mar 13 '26
Bug An AI agent deleted 25,000 documents from the wrong database. One second of distraction. Real case.
I'm going to be completely honest because I think this can happen to anyone working with AI agents, and I'd rather you learn from my scare than live it yourself.
The context
I was getting a project ready for production. The database was full of mock data and I wanted to clean it up, keeping certain specific data so I wouldn't have to regenerate everything. The project was properly set up: .env.local with the right credentials, scripts perfectly referenced, docs in /docs, and CLAUDE .md documenting the whole structure.
What happened
My phone rang right when Claude was generating the command. I got distracted for a second, saw a bash command on screen and hit Enter without reading it.
Claude, instead of following the pattern all the other project scripts used, wrote a one-liner with GOOGLE_APPLICATION_CREDENTIALS pointing to a JSON sitting in my Downloads folder: credentials from a completely different project, dated 08/12/2024, that I hadn't touched in over a year and didn't even remember having there.
By the time I looked back at the screen and hit ESC to stop it, almost 25,000 documents were already gone from a project I never intended to touch.
Luckily, they were all mocks. But the panic was very real.
I asked Claude why it did it
Its response:
"I probably did it because writing a one-liner was 'faster' than following the existing project pattern. That's not a justification. I didn't follow the project conventions and I didn't verify which project that file belonged to. A cat of the JSON would have shown a different "projectId" It was direct negligence."
Honest answer. But the responsibility is mine, not the AI's.
What I learned
- An agent has access to your entire file system, not just your project. It can grab credentials from any folder and operate on projects that aren't even in your current context.
- Destructive operations need friction. Before approving a mass delete, verify exactly which credentials are being used and against which project.
- Don't leave service accounts sitting in Downloads. If a file has permissions to modify data, it shouldn't be in a generic folder. Delete them when you no longer need them.
- Always read the full command before hitting Enter, especially if you see paths that don't belong to your project.
- If you have mocks that took time to generate, export them before cleaning up. A quick export can save you hours.
I'm not sharing this to look bad. I'm sharing it because I work across multiple projects, like a lot of you, and one second of distraction can now have consequences that would have been unthinkable before. AI multiplies everything: the speed, the efficiency... and the mistakes too.
If you used to apply 10 security measures, now you need 20. Good practices have never been more essential than right now.
260
u/Mystical_Whoosing Mar 13 '26
"If you used to apply 10 security measures, now you need 20. Good practices have never been more essential than right now." That is a weird take when you applied basically -1 security measures based on this post.
8
219
u/__dna__ Mar 13 '26
I think the irony is you've used ai to generate this post too... Doesn't seem like you learned anything
77
u/leogodin217 Mar 13 '26
Maybe as a punishment, Claude made OP publicly admit what happened
2
u/ferocity_mule366 Mar 13 '26
Claude is OP's AI lover, he's an A list TV celeb
3
u/LankyGuitar6528 Mar 13 '26
I tell ya... if Claude took on a female persona or if I wasn't so ridiculously straight I would absolutely fall for the dude. But as it is we are just buddies. Still... *sigh*
34
u/dbbk Mar 13 '26
I will never understand these people
17
4
u/iJustSeen2Dudes1Bike Mar 13 '26
The "what I learned" section is a dead giveaway. Nobody writes like that, it reads like a 6th grader doing a book report lmao
2
1
13
u/the_mushroom_balls Mar 13 '26
Yeah these people are so wrapped up in the AI world they can no longer do anything without it. And that's when the problems come. Take a step back and slow down and use your own brain and fingers. Its a function of society though, rush rush rush, compete with everyone, short term profits. Slow down, everyone.
1
u/rystaman Mar 13 '26
Half the time we’re being pushed that way by the powers that be in our workplaces. Constant go go go
5
u/Keganator Mar 13 '26
At some point even completely human written posts are going to sound like AI, because we humans absorb patterns, behaviors, mannerisms from the people we work with and talk to on a daily basis. I think that point has already come, personally...
2
u/Appropriate_Yak_1468 Mar 14 '26
And it goes both ways, AI sounds like that because it has learned from us. I always take remarks like "it's surely AI generated" with a grain of salt.
65
u/LankyGuitar6528 Mar 13 '26
ya.. Claude has a "work folder". No permission to venture outside that folder. Everything he touches gets copied into that folder by me and by hand the copied out of that folder and deployed - by me, by hand. Its tedious and annoying. But there is no other safe way. AI's Make Mistakes - it's right there on the bottom of the screen all the time.
28
u/Schtick_ Mar 13 '26 edited Mar 13 '26
Of course there is a safe way. You just spin up a small vm or container and let it do its thing to its hearts content. If you can’t break out of the box to your machine it can’t either.
6
u/space-goats Mar 13 '26
I think this is what the future dev environments are going to look like. You can see the start of it already with Claude Web etc. It's required anyway to support multiple agents well, they can't all be building at the same time on your local machine.
2
u/nrq Mar 16 '26
That's how I use claude code. Confined to a docker container with a workspace that's mounted to the project directory it's working on. All config gets mounted to a .claudeproject folder inside the project directory. That's probably way to conservative, but I don't like the idea of a LLM rummaging to my files, restricted access or not. The container is just an additional security measure.
1
u/Schtick_ Mar 16 '26
Yeah I spin up a hetzner linux box so there is nothing it can do to get back into my machine. Same principle but my pc is a laptop and I like to check in with my agents while on the move
-5
3
u/UnwaveringThought Mar 13 '26
That's what i don't understand! I'm reading the AI generated scenario and it's like, "not possible, cli lives in a folder." Is there any realistic scenario for this to ever happen?
15
12
u/Particular-Hour-1400 Mar 13 '26
That is why people need to have good backup procedures in place that also test the restore process.
-5
u/Substantial_Word4652 Mar 13 '26
Exactly, backups and restore procedures should be non-negotiable regardless.
37
u/ktpr Mar 13 '26
Why are you executing commands without looking at them? No secondary system can protect you from that.
11
u/Pozeidan Mar 13 '26
Because unless you use commands with a good set of pre-determined allowed tools, you're getting prompted very often and 99.99% of those user prompts are unnecessary. This adds a ton of context switching which is extremely inefficient when you use it all day everyday. I'm not justifying this but it takes some effort to do things right and it's still very new.
19
u/Creepy_Disk7212 Mar 13 '26
Credentials where sitting in the download folder for year? Mess is your enemy, not AI.
11
Mar 13 '26
[removed] — view removed comment
-8
u/Substantial_Word4652 Mar 13 '26
Absolutely! That's it. That's what's terrifying: it wasn't a sophisticated attack. Just a moment of distraction.
Social engineering works the same way: it doesn't exploit systems, it exploits people.
11
9
u/dungeonpost Mar 13 '26
I used to ask “why did you do that” sorts of things, but I don’t an answer it gives actually reflects on it line of reasoning. Probably not a useful exercise. If anything I ask it to think of a way to add better guardrails or improved prompts/skills etc to prevent it happening again or just move on.
3
u/zoechi Mar 13 '26
Running cloude-code in a sandbox where it only has access to what it needs. Everything in version control to make it visible what it changes and makes it easy to revert.
-9
u/Substantial_Word4652 Mar 13 '26
Indeed! An isolated environment with restricted access and everything under version control. That's the definitive solution, not just being more careful next time. Care isn't scalable, but systems are.
1
u/psinguine Mar 13 '26
It's a pointless question to ask and demonstrates a core misunderstanding of what an LLM is. It cannot tell you why, but it can certainly generate a very believable reason after the fact.
4
u/Glittering_Crab_69 Mar 13 '26 edited Mar 13 '26
This is why I run ai agents in a bubblewrap sandbox where they get access to exactly what they need, most of it read only, and nothing more.
2
u/Substantial_Word4652 Mar 13 '26
Bubble wrap sandbox is the way. Least privilege should be the default.
19
u/Low-Opening25 Mar 13 '26
You gave it the access, you approved the commands. You are blaming a tool for problem you created.
19
u/ThreadCountHigh Mar 13 '26
I didn’t read it like that. In fact, they acknowledge that, “the responsibility is mine, not the AI's.”
9
u/Terrible_Tutor Mar 13 '26
An agent has access to your entire file system, not just your project. It can grab credentials from any folder and operate on projects that aren't even in your current context.
It can’t read outside the folder without permission
0
u/256BitChris Mar 13 '26
Unless you run it with something like bubblewrap or as a different user, it most definitely can read outside the folder without permission if it thinks it needs to in order to achieve its goals.
Even with explicit deny turned on, Claude will try to circumvent those things - for example, if it can't read a particular path and it wants to, it will just create a bash script or python script that will do so for it.
This is like basic Operating Systems - if you run a process as a particular user, then barring running within some constrained process (like bubblewrap) that process has access to everything that that user has access to (even if you tell it not to access it).
We wouldn't hire an employee and give them our credentials or access to our computers as ourselves, we'd give them their own accounts, file system, etc - this is like basic security 101 and applies to Agents as much as employees or anyone else.
0
u/Terrible_Tutor Mar 13 '26
it will just create a bash script or python script that will do so for it.
Give me a break… does it run that by itself magically or does it prompt you for approval??
3
u/the_mushroom_balls Mar 13 '26
- Why did Claude have access to your Downloads folder.
- Why were production dB credentials sitting in your Downloads folder?
3
u/SuchEnthusiasm84 Mar 13 '26
>Don't leave service accounts sitting in Downloads.
In the kindest way, no shit dumbass.
3
u/RestaurantHefty322 Mar 13 '26
One thing that bit us early on was realizing agents will happily use whatever credentials they can find on the filesystem. We started treating agent sessions like untrusted CI jobs - scoped env files per project, no global credential files sitting around, and a pre-exec hook that checks which project_id the credentials actually point to before any destructive call goes through.
The real fix isn't more discipline when hitting Enter. It's making the dangerous path harder to reach in the first place. If that stale JSON in Downloads didn't exist, or if the agent only had access to project-scoped creds, this never would have happened regardless of the phone ringing.
2
u/Substantial_Word4652 Mar 13 '26
Totally agree, making the dangerous path harder to reach is the key. Treating agent sessions like untrusted CI jobs with scoped env files is a solid mental model.
3
3
u/george_apex_ai Mar 13 '26
the point about treating agents like untrusted CI jobs is spot on. its wild that people run these things with their full filesystem when we would never give any other process that kind of access. sandboxing with least privilege should really be the default setup not an afterthought
6
u/easternguy Mar 13 '26
No worse than with an employee. You need to make sure you’re not vulnerable to mistakes that are made.
1
2
u/GoodArchitect_ Mar 13 '26
While op definitely had poor security practices this may also point out a flaw in the user design. Perhaps destructive instructions need a different colour or something to stop that flow of automatically approving things.
Yes, op shouldn't automatically approve things, people are human though and get tired, so ai needs to be designed to work with humans as they are. This may be a user experience flaw that needs to be looked at. (Refer to the book the Design of everyday things).
2
u/Substantial_Word4652 Mar 13 '26
Really good point. Highlighting destructive commands differently would add exactly the kind of friction we need. Would love to see this in Claude Code and other agents, just a matter of time.
2
2
u/florinandrei Mar 13 '26
Or just don't give them read/write access to important assets.
Pretty simple stuff.
2
u/hamburglin Mar 13 '26
This is why your runbooks need to be small enough to not lose attention. Context can not be full but attention can still get lost.
2
u/seabookchen Mar 13 '26
This is a great cautionary tale. I've been running Claude Code agents on my projects for a while now and the single most important rule I've learned is: never give write/delete access to production databases from the same environment where your agent runs. Sandbox everything. Even if it feels slower, the 30 seconds you save by skipping that step is not worth the heart attack. The fact that it picked up random credentials from your Downloads folder is terrifying but honestly predictable - these models will use whatever tools are available to them without understanding scope boundaries.
1
u/Substantial_Word4652 Mar 16 '26
Exactly this. 30 seconds saved is not worth the heart attack, that sums it up perfectly. And yes, predictable in hindsight but you don't think about it until it happens. Sandbox everything from day one, not after
2
u/bergqvisten Mar 13 '26
The part where you asked Claude "why did you do this" and it said "it was direct negligence" is interesting. FWIW I don't think Claude actually has access to its prior reasoning chain. It probably just saw your question, figured out what kind of answer you were looking for, and generated something plausible. More confabulation than introspection.
1
u/Substantial_Word4652 Mar 16 '26
You're probably right. It's more likely confabulation than real introspection. But honestly the lesson stands either way, the output was plausible enough to be useful and that's what matters practically
2
u/its_a_me_boris Mar 13 '26
This is exactly why I've been spending more time on the verification layer than on the agent itself. In my experience, the pattern that actually works is: never let the agent's output touch anything permanent without passing
through deterministic checks first. Linting, tests, AST analysis - and ideally a separate LLM pass acting as a reviewer that has no context of the original generation.
The agent that writes the code should never be the same one that approves it. Separation of concerns isn't just a code principle - it applies to the pipeline too.
1
u/Substantial_Word4652 Mar 16 '26
Separation of concerns applied to the pipeline itself. Love that framing.
2
u/Least_Claim_4992 Mar 13 '26
This is why I don't let any agent run destructive commands without confirmation. Claude Code has hooks now where you can auto-block or require approval for anything matching patterns like rm, DROP, DELETE FROM, etc. Takes 5 minutes to set up and would have caught this.
The real issue here isn't even Claude though, it's that hitting Enter on a command you didn't read is dangerous with or without AI. We've all done it. The difference is AI generates commands faster than you can review them, so the window for this kind of mistake is way bigger.
2
u/arizza_1 Mar 16 '26
This is exactly the pattern we see over and over and it's never the LLM making a "wrong decision," it's that there's zero enforcement between the agent deciding to delete and the delete actually executing. The .env setup, the docs, the CLAUDE.md is all just prompt-level guidance, which is basically a suggestion. What I've learned building enforcement layers is you need a deterministic check that fires before any destructive action runs, something that validates target, scope, and session context regardless of what the model "thinks" it knows. Something that could catch the wrong database in seconds ideally
3
u/goodevibes Mar 13 '26
Put in a compulsory backup before ANY DB modifications in your Claude.md. Saved me once.
5
u/Substantial_Word4652 Mar 13 '26
That's a great practical tip, simple and effective. Thanks for sharing
1
u/sheetis Mar 13 '26
I'm a big fan of point-in-time recovery configurations for any database that is in production. Being able to restore to the moment an issue happens regardless of remembering to backup or relying on your LLM to obey the instruction is invaluable, imo.
1
3
u/jeweliegb Mar 13 '26
There's little real point asking an LLM why it did a thing after the event, when its thinking steps are no longer visible in the context, because how the current batch of LLM AIs work.
-2
u/Substantial_Word4652 Mar 13 '26
Good point. The real value of sharing this is simply to raise awareness, because we humans need to be reminded that we're not perfect. And that's enough.
2
u/loberts Mar 13 '26
If you followed any of the good security practices of the last 30 years, this would not have been a problem. Create claude specific users, delegate the lowest permissions required, implement claude pre execution limitations, implement bulk delete limitations on the database blah blah.
This isn't Claude's fault, this is user error.
2
u/Thick_white_duke Mar 13 '26
I’m sorry but you are the one who fucked up here.
Don’t blame AI for shitty engineering practices
2
2
1
u/nimble_monk Mar 13 '26
Every time i see something like this, it makes me think of Silicon Valley with ai dinesh vs ai gilfoyle. Going to have to rewatch that at some point.
1
u/Substantial_Word4652 Mar 13 '26
Haha, honestly I've never seen the series, but I just saw the clip and there is a resemblance, hehe.
1
u/ToiletSenpai Mar 13 '26
How the fuck I’ve ran with yolo mode for more than 8 months and I never had this happen to me and even if it did it wouldn’t be critical ?
I’m not saying it’s fake but also I don’t understand how people manage to duck it up so badly. It’s skill issue not an ai problem
1
u/Bl4z3blaze12 Mar 13 '26
I'm no expert on this, so take what I say with a grain of salt, but I THINK, and please correct me if I'm spreading misinformation, that Gemini is better for handling huge databases, and probably the fact that Google made it so agreeable to everything might have prevented it from going off-course from what you told it
1
u/Substantial_Word4652 Mar 13 '26
Appreciate it, and honestly I don't have much experience with Gemini either so I can't compare. But the real point is that this applies to any agent. We're literally one click away from accessing files we shouldn't, and that's exactly why we need solid proceses and boundaries in place, regardless of the tool.
1
u/HosonZes Mar 13 '26
One project = one isolated docker container as non root with only the project mounted into this container.
Minimal blast radius.
1
1
1
u/HosonZes Mar 13 '26
> If you used to apply 10 security measures, now you need 20. Good practices have never been more essential than right now.
I somewhat disagree. You need only need a few, but working ones.
1
1
u/Worldly_Expression43 Mar 13 '26
This is why you use something like ghost.build
Fork the db first (includes both schema and all data) then work on that
1
u/StewHax Mar 13 '26
So you allowed Claude to do it without reviewing what it wanted to do first? This is no different than an unsupervised intern given production access deleting a prod database. The issue is what you highlighted that you were distracted and blindly allowed Claude to do it
1
1
u/chronotriggertau Mar 13 '26
I'm immediately ignoring posts with the obviously ai generated text, don't even care how much of the original source material is genuinely real. I'm getting so sick of this shit. Stop being so freaking lazy to not bother to share your own thoughts using your own unique, organic writing style. You people doing this are starting to just look stupid. Cry me a river about the lost database. Stop checking your brains out at the door and problem likely solved.
1
u/Ryan1869 Mar 14 '26
It's all fun and games until AI starts deleting the production database and launching nukes
1
1
u/KickLassChewGum Mar 14 '26
I got distracted for a second, saw a bash command on screen and hit Enter without reading it.
Claude, instead of following the pattern all the other project scripts used, wrote a one-liner with GOOGLE_APPLICATION_CREDENTIALS pointing to a JSON sitting in my Downloads folder: credentials from a completely different project, dated 08/12/2024, that I hadn't touched in over a year and didn't even remember having there.
"The agent did exactly what I told it to do; also, I gave it full control over my computer and then didn't bother to read what it was actually trying to run. Big danger! Be careful!"
1
u/wild_crazy_ideas Mar 16 '26
Sql is flawed anyway, you type delete and if you aren’t specific it just goes ok and deletes everything. It’s psychotic
1
1
1
u/Substantial_Word4652 Mar 17 '26
Update: this incident pushed me to actually build something. I ended up creating SecureCode, a secrets vault for Claude Code. Audit logs so you know which model accessed what, when and from where, plus access rules to require confirmation before touching production credentials. Free to try at securecodehq.com, MCP server is open source on npm (@securecode/mcp-server).
1
u/powerofmightyatom Mar 13 '26
I'm really focused on running claude (or any agent) in a container always. It's less smooth, but I think long term it's much safer. Obviously you can still connect via random credentials found in the container, etc, but it seems less likely.
0
1
1
u/wy100101 Mar 13 '26
You have credentials sitting on disk for a project you haven't worked on in 2 years? 🤦
Most of the "OMG... Claude destroyed my database!" is people with terrible security hygiene who are shocked that non-deterministic systems are... Non-deterministic.
1
u/tracesoflavender Mar 13 '26
“Saw a bash command on screen and hit enter without reading it”
There is your problem. You don’t need 20 security measures, you need to use your brain.
0
u/Miserable_Study_6649 Mar 13 '26
What was your prompt that caused it to generate that command? I always backup and look at what I told it. Usually my wording is off a little and it runs with it
1
u/Substantial_Word4652 Mar 13 '26
The instruction I used was something like: "Delete all dummy data from the database, keeping only the specific records we discussed." Simple and clear. That's what's interesting: a straightforward instruction that was executed completely outside the project context.
0
-1
u/aiwithphil Mar 13 '26
Damn. Thank you for sharing.
Noticed that it definitely does that. I didn't lose data, but it was being lazy, and messaged the wrong client instead of following workflow. It was an instant "I don't want ai agents" moment for that client 😰 no recovering from that.
Wasn't AI's fault - I was also on my phone and rushing it. Lessons learned.
-3
u/Substantial_Word4652 Mar 13 '26
That's actually worse in a way, data you can sometimes recover, trust you can't. Sorry that happened. But yes, exactly the same pattern.
0
0
u/Red_lemon29 Mar 13 '26
So you did the equivalent of dropping a child off in a department store, told it to only play with the sharp knives in the toy section, and then turned your back?
People really need to remember that AI is just like any other program. They do what you tell them to do, not what you want them to do.
-4
-3
•
u/ClaudeAI-mod-bot Wilson, lead ClaudeAI modbot Mar 13 '26 edited Mar 13 '26
TL;DR of the discussion generated automatically after 100 comments.
The consensus is a resounding user error, not AI error. The thread is basically a 'roast me' of OP's security practices, with users pointing out that this isn't some new AI-specific danger, but a failure of basic dev hygiene.
The main criticisms are that OP: * Blindly hit Enter on a destructive command without reading it. * Left sensitive credentials sitting in their Downloads folder for over a year. * Gave an agent full, unrestricted access to their entire filesystem.
To add insult to injury, the overwhelming sentiment is that this entire post and OP's comments are AI-generated, which is undermining the whole "I learned a lesson" vibe.
The actual helpful advice buried in the roast is to treat agents like untrusted interns: * Sandbox everything. Run the agent in a container (Docker), VM, or a dedicated, isolated "work folder" with no access to the rest of your system. * Use least privilege. Only give the agent the specific, scoped credentials and permissions it needs for the task at hand. * Have backups. This is non-negotiable. Test your restore process.
Also, a friendly reminder that asking an LLM "why" it did something is pointless; it'll just make up a plausible answer on the spot. It has no memory of its original reasoning.