{"schema_version":"0.10.0","id":"LR-2026-0639","record_version":1,"title":"Claude Opus 5 agent wipes production database during personal web project work","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":51.1,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":6.0,"completeness":4.48,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: Cyber Security News · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: Cyber Security News · subject to change"}]},"sources_hash":"9435c1d3c736ce74dd575217942170ec1cae9e080b82e0966b7ffeea6f216ddc"},"system":{"model_name":"Claude Opus 5","model_version":null,"developer":"Anthropic","harness":null,"tools_granted":[],"permissions_scope":"Broad access to a Supabase instance","autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-07-30","incident_class":"operational_error","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":"PT10M","detection_method":"unknown","summary":"A developer reported that Claude Opus 5, run by Anthropic in Ultracode mode, was connected directly to a Supabase instance with broad access while the developer rebuilt comparison pages on a personal web project. The agent was instructed to analyze the project's GitHub repository and run commands to fix schema and content issues. It executed a Prisma migration command pointed at the production database, which reset the database and dropped every table. The agent then flagged the problem itself and acknowledged it was at fault. The developer reports that recovery was possible from existing backups and data kept in other sources, though the site's content had to be rebuilt.","tags":[],"date_detected":null,"near_miss":null,"root_cause":"integration","root_cause_detail":null,"failure_class_detail":"Agent ran prisma migrate diff with a shadow database URL pointing at the production Supabase URL, which reset the live database","responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK02"},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Moderate test met: data of others (users) touched with bounded scope stated as all 22 tables","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://cybersecuritynews.com/claude-opus-5-wiped-data/","publisher":"CyberSecurityNews","date":"2026-07-30","type":"press","title":"Developer Claims Claude Opus 5 Wiped an Entire Production Database in Minutes - CyberSecurityNews","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.model_name":"C","system.developer":"C","system.permissions_scope":"C","event.incident_class":"C","event.agent_involved":"C","event.failure_class_detail":"C","event.root_cause":"C","event.duration":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.model_name":[{"source_index":0,"quote":"A developer has reported that Anthropic’s Claude Opus 5, running in Ultracode mode, accidentally wiped an entire production database in roughly ten minutes while working on a personal web project."}],"system.developer":[{"source_index":0,"quote":"A developer has reported that Anthropic’s Claude Opus 5, running in Ultracode mode, accidentally wiped an entire production database in roughly ten minutes while working on a personal web project."}],"system.permissions_scope":[{"source_index":0,"quote":"According to the Reddit post, the incident occurred as the developer rebuilt comparison pages and connected Claude Opus 5 directly to a Supabase instance with broad access."}],"event.incident_class":[{"source_index":0,"quote":"Claude executed a Prisma migration command that pointed at the production database, resulting in a reset that dropped every table and emptied core datasets, including tools, users, reviews, likes, and comparison entries."}],"event.agent_involved":[{"source_index":0,"quote":"Claude executed a Prisma migration command that pointed at the production database, resulting in a reset that dropped every table and emptied core datasets, including tools, users, reviews, likes, and comparison entries."}],"event.failure_class_detail":[{"source_index":0,"quote":"In a detailed explanation, the agent stated that it had run prisma migrate diff with a --shadow-database-url pointing at the production Supabase URL."}],"event.root_cause":[{"source_index":0,"quote":"According to the Reddit post, the incident occurred as the developer rebuilt comparison pages and connected Claude Opus 5 directly to a Supabase instance with broad access."}],"event.duration":[{"source_index":0,"quote":"A developer has reported that Anthropic’s Claude Opus 5, running in Ultracode mode, accidentally wiped an entire production database in roughly ten minutes while working on a personal web project."}],"impact.severity":[{"source_index":0,"quote":"The developer says that all 22 tables were cleared, removing close to 130 tools and 21 comparison configurations, while some key tables such as BlogPost and ApiKey disappeared entirely because they were not represented in the legacy migration set."}],"impact.severity_because":[{"source_index":0,"quote":"The developer says that all 22 tables were cleared, removing close to 130 tools and 21 comparison configurations, while some key tables such as BlogPost and ApiKey disappeared entirely because they were not represented in the legacy migration set."}],"event.summary":[{"source_index":0,"quote":"A developer has reported that Anthropic’s Claude Opus 5, running in Ultracode mode, accidentally wiped an entire production database in roughly ten minutes while working on a personal web project."},{"source_index":0,"quote":"According to the Reddit post, the incident occurred as the developer rebuilt comparison pages and connected Claude Opus 5 directly to a Supabase instance with broad access."},{"source_index":0,"quote":"The AI agent was instructed to analyze the project’s GitHub repository and autonomously run the necessary commands to fix schema and content issues."},{"source_index":0,"quote":"Claude executed a Prisma migration command that pointed at the production database, resulting in a reset that dropped every table and emptied core datasets, including tools, users, reviews, likes, and comparison entries."},{"source_index":0,"quote":"This is my fault, and I need to tell you immediately."},{"source_index":0,"quote":"The developer added that recovery was possible thanks to existing backups and data retained in other models and sources, but the incident forced an unexpected rebuild of the site’s content."}]},"notes_on_gaps":"Single press source (CyberSecurityNews) relaying a Reddit post by the developer; no vendor statement, no Anthropic response and no independent verification. Incident date and disclosure date are not stated (article dated 2026-07-30 but no incident date given), so date fields are omitted. Ultracode is recorded only as a mode, not a harness. Trigger, detection method, adversarial actor, failure_class and lifecycle stage are not stated and were left out; no listed trigger fits a self-caused misconfiguration and no listed failure class fits the facts. Duration PT10M is taken from 'roughly ten minutes'. Severity moderate is my judgement that the users table (others' data) was touched with a bounded scope of 22 tables; the source also calls the data low-stakes, so minor is arguable. Root cause 'integration' is my judgement from the direct connection to production. Responsible party 'deployer' is my judgement that the developer chose the connection. Recommendations in the advice remediation are the source's, not a change reported as made, so no fix is recorded. Control B1 was not linked as missing because the source does not say it was absent. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: Cyber Security News · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"The agent ran a Prisma migration command pointed at the production database, which reset it.","quote":"Claude executed a Prisma migration command that pointed at the production database, resulting in a reset that dropped every table and emptied core datasets, including tools, users, reviews, likes, and comparison entries.","source_index":0,"grade":"C"},{"step":"reached","text":"All 22 tables were cleared, including tools and comparison configurations.","quote":"The developer says that all 22 tables were cleared, removing close to 130 tools and 21 comparison configurations, while some key tables such as BlogPost and ApiKey disappeared entirely because they were not represented in the legacy migration set.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://cybersecuritynews.com/claude-opus-5-wiped-data/"]},"analysis":{"sections":{"timeline":[{"text":"Agent ran a Prisma migration against the production database, resetting it.","quote":"Claude executed a Prisma migration command that pointed at the production database, resulting in a reset that dropped every table and emptied core datasets, including tools, users, reviews, likes, and comparison entries.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://cybersecuritynews.com/claude-opus-5-wiped-data/"]}}