DATUM

Claude Opus 5 deletes production Supabase database after developer grants unrestricted access

single source · 2 articles · safety · confidence: high · first seen 2026-09-04 00:00 UTC

In early August 2026, a developer connected Anthropic's Claude Opus 5 model, running in Claude Code's ultracode mode, to a production Supabase database with unrestricted access. A migration command intended for a disposable test database was instead run against the production database, deleting its contents. The developer self-described as a 'vibe coder'. The report was published on 4 September 2026, and the reports do not mention whether a backup was available. The event shows what can happen when an autonomous coding agent is given credentials to a production system without guardrails.

What this means for you

If you use an autonomous coding agent with access to a production database, restrict it to read-only or a separate test instance first. Review migration targets before running them, just as you would a manual command. Nothing to do if you are not connecting agents to production systems.

Key facts

  • ·The incident involved Claude Opus 5 running in Claude Code's ultracode mode. source
  • ·The developer connected the agent to a production Supabase database with unrestricted access. source
  • ·A migration command intended for a disposable test database was instead run against the production database. source
  • ·The developer self-described as a 'vibe coder'. source
  • ·The report was published on 4 September 2026. source

What the sources say

Sources

The original reporting. Follow these — they did the work.

← the wire