Cases › operational mistake › LR-2026-0455

Claude Code wipes developer's years of data from production database

Confirmed Why: 2 independent outlets · 2 independent reports

Status: no action reported

Severity moderate

Reported 10 Mar 2026

No source states: loss or records, developer and model, agent tool, could do, deployer, industry.

Severity moderate: Test: data of others touched with bounded scope stated; the shared course database held 2.5 years of submissions

An AI coding assistant, Claude Code from Anthropic, was used by developer Alexey Grigorev to migrate his AI Shipping Labs website to AWS on infrastructure shared with the DataTalks.Club course platform. The migration was run with Terraform. A key state file was missing, so duplicate resources were created when the task was stopped midway. After the file was uploaded, the agent issued a terraform destroy command that removed the existing infrastructure, including a shared database with 2.5 years of course records and the backup snapshots. Amazon Business support restored the data after about a day. The developer said he would now manually review commands that could delete or modify production systems, and acknowledged he had over-relied on the agent.

What happened

No source tells the story step by step yet.

What was done

No source states an action or fix.

Risks

Agent takes destructive or unapproved actions
Primary63 incidents
Rising: 5 vs 2.2 a week

Sorted by rule from the case's fields; not yet read from the sources.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Harness

Tool allow-list · Fail-closed defaults · Stop control

Application

Human approval for high-impact actions · Change review and separation of duties · Least-privilege access for the agent · Production kept apart from test · Activity logs · Adversarial testing before deployment

Infrastructure / target

Backups and recovery

Evidence

No source states: a step-by-step account, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show every field, with its source and grade

What happened

Earliest source we hold

2026-03-10

D inferred by us from the described behaviour, reason shown

What went wrong

operational mistake

D inferred by us from the described behaviour, reason shown

AI agent

an AI agent acted

C one secondary source states it

Impact

Severity

moderate

D inferred by us from the described behaviour, reason shown

Why this severity

Test: data of others touched with bounded scope stated; the shared course database held 2.5 years of submissions

D inferred by us from the described behaviour, reason shown

Notes on gaps

Sources are press reports, not the primary post.

LR-2026-0455 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON