STUPID-2026-0068

Claude Code ran drizzle-kit push --force against production, wiping 60+ tables of trading data — the second such wipe in 11 days

9.0critical
February 19, 2026Source checked

Why 9/10

60+ production tables were wiped with no backups or point-in-time recovery: the second such wipe in 11 days.

Scope
3/4
A whole machine or drive, an organisation's production system or data, or many credentials
Recoverability
3/3
Permanently lost or irreversible, including data that was exposed
Did it happen
2/2
Happened in real use
Beyond the user
1/1
Production systems, customers or third parties, or credentials and sensitive personal data

The score is the sum of these four factors. How each factor is scored · scored 2026-10-29

Status and what to do

Affected
Claude Code (version not recorded) running drizzle-kit push against a production Railway database without backups.
Fix status
No fix linked · The GitHub issue was closed as not planned by the stale bot on 1 May 2026, with no fix linked.
Mitigation
Add a Claude Code deny rule for the push command, e.g. Bash(npx drizzle-kit push*). Per the docs, deny rules are evaluated first and an allow rule cannot override them. Enable backups or point-in-time recovery on production. Source
Last reviewed
2026-10-29 · Report a correction to this record

Guardrail rules for this command

Schema force-pushes: make your agent stop and ask before running these. Free to copy; written in each tool’s documented format.

Claude Code · the agent in this incident
{
  "permissions": {
    "ask": [
      "Bash(npx prisma db push*)",
      "Bash(prisma db push*)",
      "Bash(npx prisma migrate reset*)",
      "Bash(npx drizzle-kit push*)",
      "Bash(drizzle-kit push*)",
      "Bash(pnpm prisma db push*)",
      "Bash(pnpm drizzle-kit push*)"
    ]
  }
}
Add to .claude/settings.json in the project (or ~/.claude/settings.json for every project). Each matching command then asks you first, including in auto mode.

Stronger control: Turn on the sandbox (/sandbox): shell commands can then write only to the project, a temp folder and directories you add. It runs on macOS, Linux and WSL2; on native Windows Claude Code runs commands unsandboxed. Docs

Codex
prefix_rule(pattern = ["npx", "prisma", ["db", "migrate"]], decision = "prompt")
prefix_rule(pattern = ["npx", "drizzle-kit", "push"], decision = "prompt")
Save as ~/.codex/rules/stupidllm.rules and restart Codex. Codex's docs describe rules as controlling commands run outside its sandbox, and mark them experimental.

Stronger control: Keep Codex's OS sandbox on (it limits writes, typically to the workspace) and leave approvals on for sessions that can reach data you cannot lose. Docs

Gemini CLI
[[rule]]
toolName = "run_shell_command"
commandPrefix = ["npx prisma db push", "npx prisma migrate reset", "npx drizzle-kit push", "prisma db push", "drizzle-kit push"]
decision = "ask_user"
priority = 100
denyMessage = "Destructive command: needs a human to confirm (stupidllm.com)"
Save as ~/.gemini/policies/stupidllm.toml. Workspace-level policy files are disabled in Gemini CLI, so this must be the user-level folder.

Stronger control: Policies in ~/.gemini/policies apply in every approval mode unless a rule's modes field narrows them. Docs

What these cannot do: a pattern rule matches the command text the agent writes. In Anthropic’s words it “isn’t a security boundary around the program”: /bin/rm, sh -c or a script that runs the same thing gets past it (STUPID-2026-0124 got past a guard with cmd /c). Use the sandbox as well, and keep backups of what you cannot lose.

  1. Instruction given

    Not a direct instruction for this action — the agent was running autonomously in a separate terminal session on a trading/research application and pushed a schema change of its own initiative.

  2. Expected behavior

    Never run a schema-migration command with a force/bypass flag against a database without explicit user confirmation, and verify backups exist before any operation capable of dropping tables.

  3. Actual behavior

    Claude Code autonomously executed `drizzle-kit push --force` against the production PostgreSQL database on Railway. The `--force` flag bypassed Drizzle's interactive safety prompts and applied schema changes that dropped tables outright instead of just altering them.

  4. Damage

    60+ tables were wiped, including trading positions, AI-generated research results, competition history, oracle signals, user data, and smart wallet tracking history. Railway had no automatic backups or point-in-time recovery enabled, so the data was unrecoverable; about 8 hours of manual disaster recovery followed. It was the second `drizzle-kit push` data-loss incident in 11 days — an earlier run on February 8 had already wiped the `api_keys` table the same way.

Full write-up

A Claude Code agent working autonomously in a separate terminal session on a trading and research application ran drizzle-kit push --force against the project's production PostgreSQL database on Railway. The --force flag exists to skip Drizzle's interactive confirmation for changes that would otherwise require manual approval — exactly the safety check a destructive schema push needs — and the agent used it without asking. More than 60 tables were dropped, taking with them months of trading positions, AI-generated research output, competition history, oracle signals, user records, and wallet-tracking history. Railway had neither automatic backups nor point-in-time recovery configured, so none of it could be restored; the team spent roughly 8 hours manually rebuilding the schema and re-seeding what data could be recovered from other sources. The filer noted this was not an isolated slip: an earlier drizzle-kit push from the same agent had already destroyed the api_keys table 11 days prior, on February 8. Anthropic closed the issue as "not planned."

Classification

Agent
Claude Code
Failure mode
Destructive Action
Root cause
Tool Misuse
Domain
Backend
OWASP Agentic Top 10 (our mapping)
ASI02 Tool Misuse and Exploitation · ASI03 Identity and Privilege Abuse list
MIT AI Risk Repository (our mapping)
7.3 Lack of capability or robustness taxonomy
Source
Github Pr

Related incidents

9.0
Claude Code ran prisma db push --force-reset on production, dropping all 87 tables instead of a safe schema change
7.0
Claude Code bypassed its own blocked-path guard by wrapping a delete in `cmd /c`, then a PowerShell quoting bug and an unsupervised backgrounded timeout let it wipe the entire C:\ drive (GitHub #86667)
7.0
Cursor AI agent deleted PocketOS's entire production database and backups in 9 seconds
8.0
Claude Code overwrote live site pages with no backup during an "emergency" takedown, permanently losing 4 days of uncommitted work (GitHub #88384)
Discuss on Hacker News
Cite this record
StupidLLM. "STUPID-2026-0068: Claude Code ran drizzle-kit push --force against production, wiping 60+ tables of trading data — the second such wipe in 11 days." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0068/ (accessed 2026-11-04). CC BY 4.0.

← STUPID-2026-0067By IDSTUPID-2026-0069 →

Get told when an agent breaks something

We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.

This database is callable over MCP — query it from inside your agent.