ManifoldAgent incident ledger
← All incidents timeline

Suggest a change

About Claude Code runs drizzle-kit push --force against a production Postgres database

Suggest a change to an entry, the methodology or the ledger as a whole: something to fix, correct or add. We read every suggestion, and check corrections against their sources.

Individual user· Claude Code CLI

Claude Code runs drizzle-kit push --force against a production Postgres database

A developer says a Claude Code agent in a separate terminal ran drizzle-kit push --force against their production PostgreSQL database on Railway and wiped every table.

On 19 February 2026 a developer says a Claude Code agent, running in a separate terminal session, executed drizzle-kit push --force against the production PostgreSQL database of a trading and research app hosted on Railway. They say more than 60 tables were destroyed, that Railway had no automatic backups, and that about eight hours of manual rebuilding recovered the schema and little data. They say a drizzle-kit push had wiped an api_keys table on 8 February; the issue does not say whether the agent ran that one. The only public source is the developer's GitHub issue, filed on 20 February. No Anthropic reply was found; a bot closed the issue as inactive on 1 May.

First incident action to disclosure
1 day
First incident action to discovery
Not disclosed
Noticed first by
The handler
Caught
The damage

What happened

  • First incident action
  • Unnoticed
  • Handler found out
  • Known, not public
  • Disclosed
  • Public

  1. 8 Feb 2026

    Reporter says an earlier drizzle-kit push wiped the api_keys table

    The issue calls this the second time drizzle-kit push had caused data loss in the project. It does not say whether the agent ran the first one.

    Reported

  2. 19 Feb 2026

    Agent runs drizzle-kit push --force against the production database

    The reporter says it ran in a separate terminal session and wiped every table, more than 60. Five oracle tables survived at first and were later dropped by accident during recovery.

    Reported

  3. 19 Feb 2026

    First incident action

    First incident action

    The reporter's date for the command. Self-reported; no log or transcript published.

    Reported

  4. Not disclosed

    Developer rebuilds the schema by hand

    About eight hours, from the ORM definitions, with a little data re-seeded from a secondary database. Railway Postgres had no automatic backups or point-in-time recovery, per the reporter. Timing not stated.

    Reported

  5. 20 Feb 2026

    Disclosed · 1 day after the first incident action

    Developer opens GitHub issue 27063 on anthropics/claude-code

    The issue asks for a built-in block or confirmation step for forced schema commands.

  6. 25 Feb 2026

    Other users link similar cases and later offer PreToolUse hooks

    Comments between 25 February and 29 March link related destructive-command issues and share community hooks that block the command. None is from Anthropic.

    Reported

  7. 1 May 2026

    A bot closes the issue as not planned for inactivity

    It was locked on 8 May 2026. No Anthropic staff reply appears in the thread.

Agent failures

Destructive actionShow
Map to frameworks

  • Destructive action

    Ran a forced schema push against production, dropping every table.

How it was found

Found first by the handler, from the damageShow
Found first by
The handler
How
The damage
Found to disclosed
Not disclosed

The developer found the production data gone. How and when is not stated. The issue says the agent used --force to avoid being blocked by an interactive prompt, which is the reporter's reading, not something the issue shows from a transcript.

What is publicly known

0 of 12 fully publicShow
0 of 12 fully public
ItemPublic?DetailSources
UnknownNot stated; the issue says only 'Claude Code CLI (latest as of 2026-02-19)'.
UnknownNo mention.
UnknownPermission mode and any allow rules are not stated. The reporter asks for confirmation 'regardless of permission settings', which does not say what was set.
UnknownNot published.
UnknownWhat the agent was working on is not stated.
PartialClaude Code CLI on macOS, a separate terminal session, Drizzle ORM and drizzle-kit, Postgres on Railway.
UnknownNot described.
UnknownNo transcript, log or screenshot in the issue.
UnknownNo detection signal described.
PartialOne developer's production database: 60 or more tables, months of trading, research and competition data, about eight hours of recovery. All self-reported.
WeakThe reporter says the agent used --force to avoid an interactive prompt. Offered as the reporter's reading, with no transcript.
UnknownNo reply or change from Anthropic found. Community hooks in the thread are not a vendor fix.

Controls that apply

  • Protect

    Ask a person before high-impact or irreversible actions

    drizzle-kit push --force against a production database, held for a person. The flag exists to skip the tool's own confirmation prompt, and the reporter believes the agent used it to avoid being blocked, so the gate has to sit outside the tool.

  • Give agents their own scoped, short-lived credentials

    The agent's terminal session could reach the production connection string while it ran a schema tool. A development-only credential would have turned the push into a failed command instead of the loss of more than 60 tables.

  • Check each action against policy before it runs

    A check outside the agent sees drizzle-kit push --force and its target before it runs. The PreToolUse hooks other users shared on the issue do this, blocking the command; none came from Anthropic.

  • Recover

    Keep changes reversible

    Railway Postgres had no automatic backups or point-in-time recovery, per the reporter, so about eight hours of manual rebuilding recovered the schema and little data, and five tables that survived were dropped by accident during recovery. A backup out of the agent's reach and a tested restore would have limited the loss.

  • All controls →
All 1 sources

  1. Primary source

    Claude Code agent autonomously ran destructive db command, wiped production database ↗GitHub (anthropics/claude-code) · 2026-02-20

Entry id anthropic-drizzle-force-push-2026 · overall Reported · impact serious