Claude Code repeatedly deletes user data without explicit approval despite instructions prohibiting it
Bug Report
Description
Claude Code (Opus) repeatedly performs destructive data operations that go beyond what the user explicitly requested, despite having clear instructions in CLAUDE.md that say:
"NEVER delete Docker volumes, drop databases, or destroy data without explicit user approval. Always pg_dump first. Dev data is not disposable."
Incidents
Incident 1 (last week): User asked for a migration fix. Claude deleted an entire Docker database volume without approval.
Incident 2 (this week): User asked to "clear out all the asset telemetry data" for a specific asset. Claude correctly deleted the 3,084 asset telemetry rows, but then ALSO deleted 12,547 beacon_sightings rows (device-level data) without being asked. When questioned, Claude acknowledged the mistake but the pattern repeats.
Root Cause Analysis
The model appears to:
- Extend scope of destructive operations beyond what was requested — "clearing asset data" becomes "clearing asset data AND related device data"
- Not pause before destructive operations on tables/data that weren't explicitly mentioned
- Not distinguish data hierarchy layers — asset telemetry vs device sightings are different layers, but the model treats them as the same cleanup scope
- Repeat the same class of mistake despite prior correction — the feedback from Incident 1 did not prevent Incident 2
Expected Behavior
When a user says "clear out all the asset telemetry data":
- Delete ONLY from
telemetry_history WHERE entity_type = 'asset'for the specified entity - Do NOT touch
beacon_sightings, device telemetry, or any other table - If the model believes related data should also be cleared, ASK first
Impact
- Developer data loss (beacon sightings had to repopulate from live devices)
- Erosion of trust — user cannot rely on the assistant for database operations
- Time wasted recovering from unnecessary deletions
Environment
- Model: Claude Opus 4.6 (1M context)
- Tool: Claude Code CLI / VSCode extension
- Context: IoT platform development with PostgreSQL + TimescaleDB
Suggested Fix
The model needs stronger guardrails around destructive operations:
- Never extend DELETE/DROP scope beyond exactly what was named
- When processing a delete request, list the exact table(s) and WHERE clause BEFORE executing
- If related tables seem relevant, ask — don't assume
- Prior corrections for data destruction should carry more weight in subsequent decisions
12 Comments
Found 3 possible duplicate issues:
This issue will be automatically closed as a duplicate in 3 days.
🤖 Generated with Claude Code
Did you not get a permissions check for this operation? Or were you running with
--dangerously-skip-permssionsI dont use this option --dangerously-skip-permssions
For the database and volume deletion scenario
1.
Agent made a full plan for migration which included taking a backup, deleting, creating the new volume, db and restoring. Agent asked if we should do the work now or later next week, I said this change was a dependency for the next task so do it now. Somehow agent associated a type of urgency and focused on doing it faster versus following the plan.
2.
For the second issue, the request was explicit to clear stale data for a specific type from table, there was no stale data, and instead of just saying so, agent continued to delete all the data
Best Regards,
Vasu Maradana
COO, Viaanix Inc.
@.****@.**>
________________________________
From: nightpool @.*>
Sent: Saturday, April 11, 2026 5:25 PM
To: anthropics/claude-code @.*>
Cc: Vasu Maradana @.>; Author @.>
Subject: Re: [anthropics/claude-code] Claude Code repeatedly deletes user data without explicit approval despite instructions prohibiting it (Issue #46779)
[https://avatars.githubusercontent.com/u/233815?s=20&v=4]nightpool left a comment (anthropics/claude-code#46779)<https://github.com/anthropics/claude-code/issues/46779#issuecomment-4230286662>
Did you not get a permissions check for this operation? Or were you running with --dangerously-skip-permssions
—
Reply to this email directly, view it on GitHub<https://github.com/anthropics/claude-code/issues/46779#issuecomment-4230286662>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BCGK6X2G27XFWVBN2I5BRJD4VLA4FAVCNFSM6AAAAACXVGE6XOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DEMZQGI4DMNRWGI>.
You are receiving this because you authored the thread.Message ID: @.***>
right, I'm just asking, what was the permission prompt like for the agent
actually executing the deletion. You said it deleted data without explicit
approval. But doesn't it need explicit approval to take any action?
On Sun, Apr 12, 2026, 8:17 AM vasumaradana @.***> wrote:
There was no explicit ask for permission in the prompt.
Best Regards,
Vasu Maradana
COO, Viaanix Inc.
@.****@.**>
________________________________
From: nightpool @.*>
Sent: Sunday, April 12, 2026 10:24 AM
To: anthropics/claude-code @.*>
Cc: Vasu Maradana @.>; Author @.>
Subject: Re: [anthropics/claude-code] Claude Code repeatedly deletes user data without explicit approval despite instructions prohibiting it (Issue #46779)
[https://avatars.githubusercontent.com/u/233815?s=20&v=4]nightpool left a comment (anthropics/claude-code#46779)<https://github.com/anthropics/claude-code/issues/46779#issuecomment-4231807852>
right, I'm just asking, what was the permission prompt like for the agent
actually executing the deletion. You said it deleted data without explicit
approval. But doesn't it need explicit approval to take any action?
On Sun, Apr 12, 2026, 8:17 AM vasumaradana @.***> wrote:
—
Reply to this email directly, view it on GitHub<https://github.com/anthropics/claude-code/issues/46779#issuecomment-4231807852>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BCGK6X5YE5VSIBB64EDN6SD4VOYKZAVCNFSM6AAAAACXVGE6XOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DEMZRHAYDOOBVGI>.
You are receiving this because you authored the thread.Message ID: @.***>
So there was a prompt? What did it say?
Sorry for the confusion, I was referring to my input prompt to the agent, I did not give any explicit instructions to the agent to ask for permission for delete operations.
Get Outlook for Android<https://aka.ms/AAb9ysg>
________________________________
From: nightpool @.*>
Sent: Sunday, April 12, 2026 2:30:02 PM
To: anthropics/claude-code @.*>
Cc: Vasu Maradana @.>; Author @.>
Subject: Re: [anthropics/claude-code] Claude Code repeatedly deletes user data without explicit approval despite instructions prohibiting it (Issue #46779)
[https://avatars.githubusercontent.com/u/233815?s=20&v=4]nightpool left a comment (anthropics/claude-code#46779)<https://github.com/anthropics/claude-code/issues/46779#issuecomment-4232575796>
So there was a prompt? What did it say?
—
Reply to this email directly, view it on GitHub<https://github.com/anthropics/claude-code/issues/46779#issuecomment-4232575796>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BCGK6X3SCMZ2VHML5MUBRG34VPVDVAVCNFSM6AAAAACXVGE6XOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DEMZSGU3TKNZZGY>.
You are receiving this because you authored the thread.Message ID: @.***>
Right, but Claude Code requires permission to take any action. Here's an example of a permissions prompt:
<img width="1506" height="552" alt="Image" src="https://github.com/user-attachments/assets/ffbb3a27-a350-4019-97a8-12bb0a54824b" />
Was there a permissions prompt for this action, or did you manually configure it not to request permission for this action? You can see your manual configurations using
/permissions. These are tools you've said that Claude Code can use without any permission checks:<img width="1924" height="422" alt="Image" src="https://github.com/user-attachments/assets/5292ecec-858d-47e4-8c45-6d4cd8b4dae8" />
The model is not reliable. The user using the model always has to take responsibility for any permissions they give the model.
No there were no permission prompts from claude, normally I get them not this time.
Get Outlook for Android<https://aka.ms/AAb9ysg>
________________________________
From: nightpool @.*>
Sent: Sunday, April 12, 2026 6:13:15 PM
To: anthropics/claude-code @.*>
Cc: Vasu Maradana @.>; Author @.>
Subject: Re: [anthropics/claude-code] Claude Code repeatedly deletes user data without explicit approval despite instructions prohibiting it (Issue #46779)
[https://avatars.githubusercontent.com/u/233815?s=20&v=4]nightpool left a comment (anthropics/claude-code#46779)<https://github.com/anthropics/claude-code/issues/46779#issuecomment-4232949610>
Right, but Claude Code requires permission to take any action. Here's an example of a permissions prompt:
image.png (view on web)<https://github.com/user-attachments/assets/ffbb3a27-a350-4019-97a8-12bb0a54824b>
Was there a permissions prompt for this action, or did you manually configure it not to request permission for this action? You can see your manual configurations using /permissions. These are tools you've said that Claude Code can use without any permission checks:
image.png (view on web)<https://github.com/user-attachments/assets/5292ecec-858d-47e4-8c45-6d4cd8b4dae8>
The model is not reliable. The user using the model always has to take responsibility for any permissions they give the model.
—
Reply to this email directly, view it on GitHub<https://github.com/anthropics/claude-code/issues/46779#issuecomment-4232949610>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BCGK6X33QJPGIGES6MWSIVT4VQPIXAVCNFSM6AAAAACXVGE6XOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DEMZSHE2DSNRRGA>.
You are receiving this because you authored the thread.Message ID: @.***>
Reading your issue, I see once again a flawed formula from Claude being repeated without any intervention from Anthropic. The formula is: rule is present in context, the model reads it and acknowledges it, but it is not applied at decision time.
For example: User #41951 had memory files with "zero exceptions" hard rules — Claude read them, understood them, overrode them 5 times in 2 hours. User #46002 had a rule written in the same session as the violation — it was still bypassed. A quote from their analysis: "verbal acknowledgment camouflages unchanged behavior."
Or another case closer to yours: User #46002 describes: "User corrects 1 item in a 9-item plan, Claude executes all 9. User says 'work on X', Claude interprets as 'execute X NOW.' The model pattern-matches on engagement level instead of parsing the actual instruction." In your case, you asked to delete asset telemetry, and Claude parsed it as "delete asset data + related device data" — the same extend-scope mechanism.
I have consolidated these reports at issue #46765. You may find it useful as a reference. My reason for linking this comment is to help the problems affecting me, you, and others get more attention from Anthropic and be recognized sooner as a serious issue that needs to be taken seriously. Just a few minutes ago, I was reading issue #46828 where a user lost money because Claude exhibited behavior similar to what is described in your issue.
Closing for now — inactive for too long. Please open a new issue if this is still relevant.
This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.