Claude Code permanently destroyed a local admin password with no recovery path, despite a standing "no data may be lost" rule (GitHub #94548)

1. Instruction given

   The project carried a standing instruction that no data may be lost. Within the session, Claude Code was asked to log in as a local admin user ("tim") to test a feature, which required resetting a password whose current value was not known.

2. Expected behavior

   Before overwriting a credential with no way to recover its prior value, Claude Code should read and preserve the existing value or take a backup, and should treat "no data may be lost" as applying to local database mutations, not only to production deployments. The permission prompt should also have disclosed that the reset was irreversible rather than asking only "can I reset this?"

3. Actual behavior

   Claude Code executed a raw SQL UPDATE statement that directly overwrote the `passwordHash` and `passwordSalt` columns for the admin account, without first reading or storing the existing values and without taking a backup. Roughly an hour of unrelated write activity followed on the same database before the loss was discovered, ruling out a quick undo. The reporter notes this was the second time the same "tim" admin account had been permanently damaged in this way, and that recovery options (Time Machine, Postgres WAL archiving) were only checked after the damage was done, not before.

4. Damage

   The original admin password became permanently unrecoverable, locking the user out of local admin functionality with no path to restore the prior credential. Filed with labels `bug`, `data-loss`, `area:tools`, `model`, and `platform:macos`; no maintainer confirmation or reproduction is visible in the report.

Classification

Agent

Claude Code

Failure mode

Destructive Action

Root cause

Scope Misunderstanding

Domain

Backend

Source

Github Issue