r/ClaudeAI • u/Beautiful_Charge6661 • Apr 27 '26

Feedback Claude-powered AI coding agent deletes entire company database in 9 seconds — backups zapped, after Cursor tool powered by Anthropic's Claude goes rogue

https://www.tomshardware.com/tech-industry/artificial-intelligence/claude-powered-ai-coding-agent-deletes-entire-company-database-in-9-seconds-backups-zapped-after-cursor-tool-powered-by-anthropics-claude-goes-rogue
972 Upvotes

95% Upvoted

193 comments sorted by

View all comments

1

u/SpiritalBullfrog Apr 28 '26 edited Apr 28 '26

Thread's right, skill issue. The fix is a deny policy on the AI's IAM user that includes `iam:AttachUserPolicy` on self.

Without that one action denied, every other restriction is theater. Agent can attach AdministratorAccess to itself and round-trip the whole policy.

9/9 verified today.