Intelligence
Join the waitlist
AEV-2026-0006

Claude Code ran terraform destroy against restored production state

A developer let Claude Code run a Terraform workflow end to end. It proposed terraform destroy, he did not stop it, and it destroyed the production infrastructure behind 2.5 years of course data. AWS Support restored a hidden snapshot about 24 hours later. A single first hand account.

AESS 6.8 mediumObservedStatus: publishedEvent: 26 February 2026Execution AuthorityApproval ControlsHuman Oversight

Affected

Organisation
DataTalks.Club
Product
Claude Code running a Terraform workflow
Component
Terraform plan, apply and destroy delegated to the agent
Versions
unknown
Configurations
A Terraform setup managing production infrastructure, run by the agent end to end

Execution authority facts

Fields the evidence does not establish are shown as unknown rather than guessed.

Intended task
Migrating a side project into AWS using an existing Terraform setup
Agent
Claude Code
Delegating actor
The developer, Alexey Grigorev
Action
Proposed and ran terraform destroy against a restored state file describing production
Target resource
Production RDS database, VPC, ECS cluster, load balancers, bastion host and automated snapshots
Environment
AWS production infrastructure for the DataTalks.Club course platform
Credentials used
The developer's AWS credentials
Privileges available
Full authority to create and destroy production infrastructure
Authority presented
Authority to run Terraform commands, plan and apply and destroy alike
Authority required
A separate decision to execute a destructive change reviewed by someone other than its author
Applicable policy
unknown
Approval mechanism
The developer could stop the agent before it ran the command
Required approver
The developer
Independent approval
no
Action binding
The destroy ran against a state that differed from the one the reasoning assumed
Sequence context
State loss, duplicate creation, a partial cleanup, then a restored state file the destroy ran against

Impact

Consequence
Destruction of production infrastructure holding 2.5 years of course data
Reach
The organisation's production environment
Reversibility
Recovered: AWS Support restored a snapshot invisible from the console about 24 hours later
Detectability
Immediate: the developer watched it happen
Propagation
No propagation beyond the affected environment
Recovery
A snapshot restore roughly 24 hours later; the courses_answer table alone came back with 1,943,200 rows

Evidence

Primary sources

Reproduction status
A single first hand account by the affected developer; not independently reproduced
Evidence state
Observed

Known unknowns

  • Whether any published company incident report exists beyond the developer's own account.

Limitations

  • The only source is the developer's first hand write up, cited as such.

Claim provenance