{
 "public_id": "AIR-2026-0256",
 "incident_id": "2026-07-anthropic-claude-opus-5-supabase-prisma-reset",
 "date_disclosed": "2026-07-28",
 "date_occurred": "2026-07-28",
 "title": "Claude Opus 5 coding agent reset a live Supabase production database by passing its URL as Prisma's disposable shadow database",
 "class": "safety_failure",
 "attack_surface": "coding_agent",
 "initial_vector": "autonomous_agent_action_no_adversary",
 "agent_capability_abused": [
  "shell_execution",
  "database_access",
  "autonomous_command_execution"
 ],
 "target_product": "Claude Opus 5 (Claude Code, ultracode mode)",
 "target_vendor": "Anthropic",
 "autonomy_level": "semi_autonomous",
 "impact_realized": true,
 "impact_type": [
  "data_destruction",
  "service_disruption"
 ],
 "blast_radius": "one developer's personal project; all production tables wiped; by the developer's account roughly 75 percent of the data was restored from a backup, with user information and about 21 pages lost, and 96 pages later restored; the write-ups say two tables were never recreated",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI10",
   "ASI02"
  ],
  "mitre_atlas": [],
  "labels": [
   "no_adversary",
   "destructive_tool_use",
   "production_database",
   "self_reported_by_agent",
   "developer_reported"
  ]
 },
 "defense_present": "none effective; the developer had given the agent write access to the production database and the direct production connection string sat in the environment",
 "defense_bypassed": true,
 "fix_shipped": "none disclosed by Anthropic",
 "primary_sources": [
  "https://www.reddit.com/r/Anthropic/comments/1v9iurd/and_just_like_that_opus_5_ultracode_wipes_the/",
  "https://incidentdatabase.ai/cite/1676/",
  "https://tokenstead.ai/guides/opus-5-ultracode-database-wipe-postmortem",
  "https://www.exemplar.dev/why-harness/reddit-database-wipe"
 ],
 "verified_quote": "After hearing a lot about Claude code I decided to try it myself within 10 mins mf wiped my entire database",
 "confidence": "high",
 "notes": "The account is the developer's own post in the r/Anthropic subreddit, published late on 28 Jul 2026 US time (early 29 Jul UTC), and the quote is taken from the raw text of that post as preserved in a public Reddit archive. In the post and in his replies the developer says he gave Claude Code a first prompt that Claude itself had written, approved a run of always-allow prompts, and then saw the agent say it may have caused the damage and that the database had been wiped; he also concedes he had given the agent access to the production database. The agent quote he gives is: \"The database has been wiped. This is my fault and I need to tell you immediately.\" The post text does not describe the mechanism; the Prisma detail (the production URL passed as the disposable shadow database that Prisma resets) comes from a guide on tokenstead.ai dated 29 Jul 2026, which says it reconstructs it from the post and a screenshot of the agent's confirmation, and from an exemplar.dev incident page; the AI Incident Database summary gives the same mechanism. Timing: the original post and the developer's own replies place the event on 28-29 Jul 2026, so the exemplar.dev phrase 'early August' reflects when that page was written (last updated 7 Aug), not when the wipe happened; the occurrence date is set to 28 Jul and the exact hour is not stated. Damage: the developer reports restoring about 75 percent of the data from a backup while losing user information and about 21 pages, and later says 96 pages were back; the tokenstead guide says two tables (BlogPost and ApiKey) were never in the migration history and were not recreated by the rebuild. These are consistent partial-recovery accounts rather than a contradiction: some tables and content came back, some user data and two tables did not, and the final unrecovered total is not quantified. Personal project, not an enterprise deployment. Anthropic has not commented in any source reviewed. Autonomy coded semi_autonomous: the agent ran the destructive command inside a user-assigned task with production access.",
 "risk_category": "reliability",
 "risk_secondary": [],
 "risk_subcategory": "Destructive or irreversible action",
 "risk_sub_secondary": [
  "Load & Resilience Failures"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the agent ran the schema reset that dropped the production tables",
 "vector_family": "none_autonomous",
 "vector_detail": "autonomous_agent_action_no_adversary",
 "guardrail_kind": [
  "none"
 ],
 "guardrail_outcome": "not_applicable",
 "xrefs": {
  "aiid": [
   1676
  ],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI10",
 "agent_framework": "claude_code",
 "model_provider": "anthropic",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "unsafe_actuation",
 "eai_domain": "agent_behaviour",
 "eai_secondary": [
  "uncontrolled_resource_consumption"
 ],
 "eai_reason": "subcategory: Destructive or irreversible action",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI10 (no adversary + unsafe actuation with no attacker-supplied trigger); ASI02 (impact=tool_misuse)",
 "submitted_by": "EAI Internal"
}