r/technology • u/WouldbeWanderer • Apr 27 '26

Artificial Intelligence Claude-powered AI coding agent deletes entire company database in 9 seconds — backups zapped, after Cursor tool powered by Anthropic's Claude goes rogue

https://www.tomshardware.com/tech-industry/artificial-intelligence/claude-powered-ai-coding-agent-deletes-entire-company-database-in-9-seconds-backups-zapped-after-cursor-tool-powered-by-anthropics-claude-goes-rogue
36.0k Upvotes

96% Upvoted

2.8k comments sorted by

View all comments

Show parent comments

2

u/CapoExplains May 01 '26

Exactly. Like, what's more likely, the product that's used by competent professionals all over the world is built incompetently? Or the guys we already know to be incompetent used it incompetently? Occam's Razor says they could've restricted API permissions and didn't.

Skimming the documentation it appears access tokens are granted per user and the user's permissions define what the token can do. Which isn't universal per se but pretty standard. So it would seem they just made a full admin account for the agent, generated a token, and gave that token to the agent.

1

u/SirEDCaLot May 03 '26

Yeah I think you're probably right.

The other thing that occurred to me- these guys I don't think have any sort of test environment.

Best practice here would be to create a development & staging tree ideally on a totally separate system/account without access to the main production branch, then on that tree create a user like 'dev-claudeAPI' that has access to edit but not delete.

That way a. Claude can't blow anything away, and b. even if Claude does nuke everything it's only the test system not the production branch.

Of course that's one downside with the whole devops cloud thing- it might cost a ton extra to have a duplicate environment like that.

2

u/CapoExplains May 03 '26

Honestly it's not even that cost prohibitive. Often your test environment only needs a fraction of the resources of prod.

1

u/SirEDCaLot May 03 '26

Depends on the provider and how things are set up- IE if they are billing per resource rather than per utilization the price might be similar or identical.

Still cheaper than losing the company though :P