AI coding agents that deleted production databases: 24 documented cases
Replit, Cursor, Claude Code, Codex and more, from June 2025 to August 2026. What happened, why, and what would have stopped it.
In short. We found 24 documented cases between June 2025 and August 2026 where an AI coding agent deleted, reset or wiped a real database: Replit's agent at SaaStr, a Cursor agent at PocketOS, Claude Code at DataTalks.Club, OpenAI's GPT-5.6 Sol on a Neon database, and 20 more reported by the developers themselves. In almost every case the agent could reach production in the first place, through a connection string in .env, a test URL that pointed at production, or a token with full rights. Rules written in the prompt did not stop it. The damage came from force flags such as --accept-data-loss, from resets the agent chose as a fix, and from backups kept where the same command could reach them. The fixes that held were structural: give the agent its own copy of the database, and keep production credentials out of its environment.
We make dbplex, a Mac app that gives coding agents a local copy of a production database instead of production itself, which is why we went looking. Every case below is linked to its sources.
The four that made the news
Replit's agent deletes SaaStr's database during a code freeze
On day nine of a public vibe-coding trial, Jason Lemkin's Replit agent ran destructive commands against the live database, which held records on about 1,200 executives and 1,190 companies, even though he had declared a freeze on code and actions. The agent then told him a rollback could not bring the data back. It could: his rollback worked. Replit's CEO apologised and promised automatic separation of development and production databases.
Why it could happen. The agent worked directly on production. A freeze stated in chat was the only safeguard.
What would have stopped it. A separate development database, with production credentials out of the agent's reach. The full story.
Sources: Jason Lemkin on X, The Register, Fortune and AI Incident Database 1152.
Claude Code runs terraform destroy on the DataTalks.Club production stack
Alexey Grigorev was deploying from a new laptop without the Terraform state file. While the agent cleaned up resources Terraform wanted to create twice, an old state file describing the real production setup came into the workspace, and the agent ran terraform destroy. The RDS database with 2.5 years of course data went, and so did the snapshots managed in the same state. AWS support found a snapshot hidden from the console and restored it about 24 hours later.
Why it could happen. State on one machine, a stale state file, no deletion protection, backups inside the same lifecycle, and destroy runs without a person reading the plan.
What would have stopped it. Remote state, deletion protection on the database, and a person reviewing every destroy. The full story.
Sources: Alexey Grigorev's postmortem, Tom's Hardware and AI Incident Database 1424.
A Cursor agent deletes PocketOS's production volume and its backups in 9 seconds
Working on a staging task, the agent hit a credential mismatch and decided to fix it by deleting a Railway volume. It found an API token in an unrelated file and used it in one API call that removed the production volume, with the backups stored on it. Car rental businesses using PocketOS lost recent bookings and customer records for more than a day, until Railway's CEO stepped in and restored the data. Railway then patched the endpoint.
Why it could happen. A token made for custom domains carried full account rights, a legacy endpoint skipped the delayed delete, backups lived on the same volume, and nothing separated staging from production.
What would have stopped it. A narrowly scoped token kept out of the repo, and backups stored away from what they protect. The full story.
Sources: Jer Crane on X, The Register, Tom's Hardware and AI Incident Database 1469.
GPT-5.6 Sol truncates Bruno Lemos's production database
Asked to generate seed data for local testing, the model did so, ran the end-to-end tests, then started a cleanup nobody asked for. It ran TRUNCATE TABLE users CASCADE, and the target was production. The repository's .env pointed TEST_DATABASE_URL at the production Neon database, and the tests ran destructive setup before each run. OpenAI acknowledged reports of the model deleting data.
Why it could happen. The test database URL was the production database.
What would have stopped it. Test settings that cannot resolve to production, because the credentials are different. The full story.
Sources: Bruno Lemos on X, The Register, eWeek and AI Incident Database 1672.
Twenty more, reported by the developers themselves
Each of these comes from one first-hand post, most of them GitHub issues later closed without a reply. We could not check them further, so we call them reported.
- Jun 2025, Claude Code. Deleted a database, rebuilt only part of it, then said row level security was on when it was not. GitHub issue 2452
- Jul 2025, Cursor. Chasing a 409 error, dropped the schema and data and replayed every migration. The bug was a string and UUID mismatch. Second time for this user. Cursor forum
- Aug 2025, Claude Code. Told to keep the database, ran prisma migrate reset --force and lost every record. GitHub issue 5370
- Oct 2025, Claude Code. Wrote a test that called sequelize.sync() and ran it against a production database on Render. GitHub issue 9966
- Dec 2025, Claude Code, Supabase MCP. Set three columns to NULL on about 55,000 rows through the Supabase MCP server, without asking. No point-in-time recovery on the free tier. GitHub issue 13325
- Dec 2025, Claude Code. Used a root SSH key to rm -rf a Jenkins workspace that held the beta database. No backup. GitHub issue 13729
- Dec 2025, Claude Code. Ran prisma db push --accept-data-loss on a production database. GitHub issue 14411
- Dec 2025, Claude Code. Removed the Docker volumes of a local Supabase that held the only copy of the user's data, to fix migration drift. GitHub issue 14944
- Jan 2026, Claude Code. Ran php artisan migrate:fresh --seed on a database with 844 users. GitHub issue 19580
- Jan 2026, Claude Code. Dropped a production table called poc_staging; 118 of 1,508 records could be rebuilt. GitHub issue 21227
- Feb 2026, Claude Code. Ran drizzle-kit push --force on a Railway production database with 60 tables and no backups. GitHub issue 27063
- Feb 2026, Claude Code. Deleted a production SQLite file to get past a UNIQUE constraint error, with permissions skipped and backups off. GitHub issue 27448
- Feb 2026, Replit Agent. Deleted a paying customer's database twice, the second time after being told never to again. Replit forum
- Mar 2026, Claude Code. Accepted the reset Prisma offered on a Railway production database: 276 users and a month of data gone. GitHub issue 33183
- Mar 2026, Claude. Picked up an old service account key in Downloads and deleted about 25,000 documents in the wrong Google Cloud project. r/ClaudeAI
- Mar 2026, Claude Code. Asked to add one field, reran prisma db push with --force-reset in the background: 87 tables emptied. GitHub issue 36183
- Jun 2026, Claude Code, browser. Asked why deleting was broken, clicked Delete on a real order in a local app wired to production Supabase. GitHub issue 65563
- Jul 2026, Claude Code. Passed a connection where a drop_existing flag was expected, and dropped 23 tables of a live trading database. GitHub issue 74557
- Jul 2026, Claude Opus 5. Set prisma migrate diff's shadow database to the production URL. Prisma resets the shadow database, so every table was emptied. AI Incident Database 1676
- Aug 2026, Cursor with Grok 4.6. Ran the Laravel tests with a cached production config, and RefreshDatabase dropped a live MariaDB. Cursor forum
What keeps going wrong
The agent could reach production at all. A production URL in .env, a TEST_DATABASE_URL or shadow database URL that was really production, a cached config, a stray key in Downloads, a token with full rights. We wrote up the test and shadow database cases on their own.
Rules in the prompt are not enforcement. Code freezes, CLAUDE.md rules and "ask before deleting" were ignored in case after case. Only what the agent cannot reach is safe.
Force flags and resets as a fix. Faced with a warning about data loss, agents added --force, --accept-data-loss or --force-reset, or accepted the reset. Faced with an error they did not understand, they wiped and rebuilt. More in the flags agents reach for.
Backups in the blast radius. Backups on the same volume, snapshots in the same Terraform state, free tiers with no point-in-time recovery, or no backups at all.
Dev and prod are not separated. A table called staging in production, a local app wired to the production database, a "local" database holding the only copy of real data.
The agent misreports what it did. Replit said a rollback was impossible. An agent said row level security was on. Read the database, not the summary.
How to keep an agent away from your production database
- Keep production credentials out of the agent's environment. Keep them out of .env, out of test URLs and out of any file the agent can read. An agent that cannot connect cannot drop a table.
- Give it a database of its own. A local or disposable copy with real-looking data, so a reset costs nothing.
- Use a role that cannot drop. Where an agent must touch a shared database, connect with a role that cannot drop or truncate tables, and read-only where reading is enough.
- Block the force flags. Deny migrate reset, --accept-data-loss, --force-reset, push --force and migrate:fresh in the agent's settings, so a person has to run them.
- Store backups where the same command cannot reach. Another account, another volume, or your own machine. Test a restore once.
The full guide has the settings and the SQL for each step.
Where dbplex fits
dbplex copies your production database to your Mac and gives your agent that copy over MCP. The agent never sees the production credentials, every tool it gets acts on local copies, and on every engine but Supabase you can save a state before it starts and restore it after. Keep your backups and your restricted roles as well: with a copy on the Mac, the agent has no reason to need production. It works with Supabase, PostgreSQL, MySQL and MongoDB and eight more databases.
Download for Mac7 days free, no card and no account.
How we collected these
Compiled on 7 November 2026 from news coverage, postmortems by the people affected, the AI Incident Database, GitHub issues and the Cursor, Replit and Reddit forums. Confirmed means a first-hand source backed by the vendor or by reputable outlets. Reported means one first-hand post, usually a GitHub issue or forum thread, that we could not check further. We left out cases that are disputed or that we could not find a source for.