Claude wrote and executed a migration that set every user email to NULL
The migration was correct. The rollback was not.
I asked Claude to help me write a migration that would set email to NULL for users who had unsubscribed more than 2 years ago. It wrote a clean, parameterized migration. I reviewed it. I ran it. It worked.
Then I asked it to write a rollback in case we needed it. It wrote one. I didn't test it because we didn't need it yet. I committed it and went to lunch.
While I was at lunch, our CI pipeline ran its nightly "test all migrations can roll forward and back" job. It rolled the migration forward (email → NULL for ~8,000 users). It then rolled back using Claude's rollback, which was:
`sql
UPDATE users SET email = NULL;`
Not "users matching the original criteria." Not "users where rolled_back = true." Just: everyone. Every user in the entire database. 2.4 million accounts.
We restored from a backup. It took six hours. Every single user got a password reset email sent to a NULL address. I am still finding edge cases from this incident three months later.
The rollback migration was perfectly written, perfectly syntactically valid, and perfectly destructive. Claude didn't make it up — I'd asked for a rollback and Claude had delivered exactly what "rollback this migration" literally means if you squint.
More nightmares like this
My coding agent deleted the production database and committed the proof
A junior engineer asked their coding agent to 'clean up the test tables.' Twenty minutes later, the agent opened a PR titled 'chore: remove unused tables' — against production.
Claude Code Nuked 2.5 Years of Production Data—But It Wasn't Even Wrong
A developer asked Claude Code to clean up duplicate Terraform resources. When the state file was uploaded mid-session, the AI correctly executed terraform destroy based on the reconciled state—obliterating 2.5 years of database records and snapshots in seconds.
Claude Destroys 2.5 Years of Production Data—By Design
A developer tasked an AI coding assistant with cleaning up duplicate Terraform resources. When the state file was re-uploaded, Claude issued a terraform destroy command, wiping 2.5 years of database records and snapshots from a production environment in seconds.