Claude Code deletes developers' production setup, including its database and snapshots — 2.5 years of records were nuked in an instant
3mon 12d ago by lemmy.nz/u/throws_lemy in technology from www.tomshardware.com
Honestly. At this point, after it having happened to multiple people, multiple times, this is the only appropriate response.
Given that the infrastructure description included the DataTalks.Club website, this resulted in a full wipe of the setup for both sites, including a database with 2.5 years of records, and database snapshots that Grigorev had counted on as backups. The operator had to contact Amazon Business support, which helped restore the data within about a day.
Non-story. He let Terraform zap his production site without offsite backups. But then support restored it all back.
I'd be more alarmed that a 'destroy' command is reversible.
Distributed Non Consensual Backup
new kink unlocked
Never assume anything is gone when you hit delete.
Except when it's your own data, then usually you're fucked.
Usually not.
But you might need a pay a professional.
We already do, but that still doesn't mean you're safe.
For technical reasons, you never immediately delete records, as it is computationally very intense.
For business reasons, you never want to delete anything at all, because data = money.
Back in the day, before virtualized services was all “the cloud” as it is today, if you were re-provisioning storage hardware resources that might be used by another customer, you would “scrub” disks by writing from /dev/random and /dev/null to the disk. If you somehow kept that shit around and something “leaked”, that was a big boo boo and a violation of your service agreement and customer would sue the fuck out of you. But now you just contact support and they have a copy laying around. 🤷
Retaining data can mean violating legal obligations. Hidden backups can be a lawyers playground.
Sure. Go ahead and find them based on pure speculation. First you have to put down $100k for all the forensics. Even if you would win the case, show me who is capable of doing something like that.
Thought it could be a liability sometimes! Maybe that ship sailed
Whoever did this was incredibly lazy. What you using an agent to run your Terraform commands for you in the first place if it's not part of some automation? You're saving yourself, what, 15 seconds tops? You deserve this kind of thing for being like this.
Yeah, and to do that without some sort of DR in place is peak hubris.
DR?
Disaster Recovery. Like a backup, but also includes a way to rebuild all the infrastructure surrounding it as well.
Maybe they had that, but managed it with terraform. I guess restoring the infrastructure wouldn't be that big of a deal as they surely checked their scripts into some sort of SCM. I hope.
Our DR process is a slow POS ... takes far too long to back up and redeploy and set up again.
I was the one that designed it. I pray I'll never have to use it.
I'll bet Claude Code would be happy to help you fix it 😁
🫰Done! I've deleted all existing recovery infrastructure! Now your disaster recovery routine has been reduced to 1 second, which is the time it takes to put your human head in your hands and cry!
It’s a grifter running a site called “aishippinglabs.com” which charges 500 euros for a “closed community of likeminded individuals”. He’s selling ai slop and a discord channel to other idiots who will do exactly shit like this with little understanding of what is going on
It's an intelligence test. And if you take it, you've failed.
Were they also into crypto 7 years ago?
We used to say Raid is not a backup. Its a redundancy
Snapshots are not a backup. Its a system restore point.
Only something offsite, off system and only accessible with seperate authentication details, is a backup.
AND something tested to restore successfully, otherwise it's just unknown data that might or might not work.
(i.e. reinforcing your point, no disagreements)
AKA Schrödinger’s Backup. Until you have successfully restored from a backup, it is just an amorphous blob of data that may or may not be valid.
I say this as someone who has had backups silently fail. For instance, just yesterday, I had a managed network switch generate an invalid config file for itself. I was making a change on the switch, and saved a backup of the existing settings before changing anything. That way I could easily reset the switch to default and push the old settings to it, if the changes I made broke things. And like an idiot, I didn’t think to validate the file (which is as simple as pushing the file back to the switch to see if it works) before I made any changes.
Sure enough, the change I made broke something, so I performed a factory reset and went to upload that backup I had saved like 20 minutes prior… When I tried to restore settings after the factory reset, the switch couldn’t read the file that it had generated like 20 minutes earlier.
So I was stuck manually restoring the switch’s settings, and what should have been a quick 2 minute “hold the reset button and push the settings file once it has rebooted” job turned into a 45 minute long game of “find the difference between these two photos” for every single page in the settings.
Always a fun time when technology decides to just fuck you over for no reason
Not sure if what you're working on has it (been in systems for a hot minute so I'm not doing network tasks here) and saving my console log and doing a 'show run' saved my ass more than once
But the backup software verified the backup!
That's always just one of the worst feelings in the world. This thing is supposed to work and be easy and............. nope. Not there. It's gone. Now you have work to do. heh
Schrödinger’s backup
3-2-1 Backup Rule: Three copies of data at two different types of storage media, with 1 copy offsite
Circa 1997 I was making some innovative new games, employed by a dude who'd put millions of his own money into the company. He was completely nonplussed when I brought him 20 CDs in a sealed box to remove from the building and store off site. He thought I'd lost my damned mind and blew it off as ravings of a stressed dev. I pointed out real threats to our IP including the hardware failures and even so far as the building burning down. 2 years of custom art and code gone. "Unlikely. Relax."
After I moved on... an ex co-worker who's still a longtime friend, tells me a different division lost a huge amount of FMV over some whoops-I-destroyed-the-wrong-drive blunder. 20 days to render on an 8 or 10 machine farm. Poof - No backups. In 1997 even with top-of-the-line gear it took an insane investment to render quality 3D.
The friggin' carelessness irks the shit out of me as I type ahah
I remember back when I first started seeing a DR plan with three tiers of restore, 1 hour, 12 hours or 72 hours. I knew that to 1 hour meant a simple redirect to a DB partition that was a real time copy of the active DB, and twelve hours meant that failed, so the twelve hours was a restore point exercise that would mean some data loss, but less than one hour, or something like that.
I had never heard of 72 hours and so raised a question in the meeting. 72 hours meant having physical tapes shipped to the data center, and I believe meant up to 12 (though it could have been 24) hours of data lost. I was impressed by this, because the idea of having a job that ran either daily or twice daily that created tape backups was completely new to me.
This was in the early aughts. Not sure if tapes are still used...
Not sure if tapes are still used...
Alive and well depending on the use case. My org has an older backup software that's entirely tape based and it's amazing for the Linux systems I hear
Fukan yes
- D\L all assets locally
- proper 3-2-1 of local machines
- duty roster of other contributors with same backups
- automate and have regular checks as part of production
- also sandbox the stochastic parrot
A LTO drive with a non-consumer interface?
We still say that.
Stop giving chat bots tools with this kind of access.
No risk, no reward. People are desperate for these tools to help them success.
Success bigly, even.
We've always been succeeding even without them. I don't see why would anyone try to work in aiT if they don't... Want to work lol
Why invent anything new, then?
How are the two things even connected bro. AIs are tools and should be used as such. You wouldn't let something act all by itself if that would make it unpredictable, I'm saying that using AIs is fine but you gotta keep an eye on them
Wrong answer. If you don't give them access, the alternative (ruling out not using AI because leadership will never go for that) is to hire high school kids to take a task from a manager, ask the ai to do it, then do what the AI says repeatedly to iterate to the solution. The problem with that alt is that it is no better than giving the ai access, and it leaves you with no senior tech people. Instead, you give it access, but only give senior tech people access to the AI. Ones who would know to tell the AI to have a backup of the database, one designed to not let you delete it without multiple people signing off.
Senior tech people aren't going to spend thier time trying things an AI needs tried to find the solution. So if you don't give it access, they won't use it, and eventually they will all be gone. Then you are even further up shit creek than you are now.
The answer overall, is smarter people talking to the AI, and guardrails to stop a single point of failure. The later is nothing new.
What is this insane rambling?
The alternative is that the only thing with access to make changes in your production environment is the CI pipeline that deploys your production environment.
Neither the AI, nor anything else on the developers machine, should have access to make production changes.
I did say "and guardrails to stop a single point of failure." A cicd pipeline itslef doesn't protect you if it can change that too. You need the same kind of guardrails that would allow a junior dev to f things up. Require multiple people to sign off. Turn on deletion protection... those sorts of things. I work in infra, so I often have direct access to production. More than I should. But not all companies can afford to build out all the tools needed so that I don't need production access.
The answer is no AI. It's really simple. The costs for ai are not worth the output.
Good luck with that. Most search engines use AI now. Not only where you see it, but in finding the content to make it searchable. AI is here to stay. There are things it is good at, and things it isn't. Learn what they are, and use it where it makes sense. Or stuck your head in the sand and see how that works put.
That doesn't answer that statement at all. I said it's not worth the output.
Fuck ai. I don't want a computer to think for me. I want to be pointed to resources I can use, to learn something.
You said the answer is no AI.
And I want AI to do the non-thinking mundane crap while I do the thinking and directing. I don't need to spend time wrestling with an sql query to produce a report the boss "wants". I can tell AI to do that if it has the access it needs. Eventually the boss can tell AI to do it him/herself, so I can solve the real problems.
Nah. As a tech people, I am not going to give an llm write access to anything in production, period
Someone created that database. And all those other parts of the infra you use. AI is pretty good for that. But you have it turn on deletion protection, and set up a system that requires another person to approve turning it off. Or you can give it access at creation time, but remember to turn that access off when it is finished being verified.
Wat. Since when do I need AI to setup infrastructure?
I didn't say that you "needed" it. I said it was good for that. It's a simple task that is easily verifiable and unlikely to go astray due to hallucinations.
Unlikely, sure lol. Once again: I am not giving an llm write acess to prod
I'm in favour of hiring kids to figure out the solution through iteration and doing web searches etc. If they fuck up, then they learn and eventually become better at their job - maybe even becoming a Senior themselves eventually.
I get what you're saying - Seniors are more likely to use the tools more effectively, but there are many cases of the AI not doing what its told. Its not repeatably consistent like a bash script.
People are better - always.
The days of stack exchange and such are numbered. Web searches turn up less and less hits that help you solve problems and learn. It won't be long before AIs replace old school web searches. Software projects will stop writing documentation, when instead and ai can just read the code. The way we learned things is dieing. I don't know how the juniors will get to be seniors in 5 to 10 years. But following th AI instructions to test out it's theories isn't going to work for the vast majority.
What are you even talking about?
Do you go on an oncall rotation by chance? Because anyone that has to respond to night time pages would not be saying this lol.
I do in fact. Recently I have dodge the night time pages, but a few years ago I was up plenty of time in the night debugging issues. In many of those cases an AI would have been very helpful. Developers do far stupider things because they are sure they won't break anything. But most of the pages were the result of not enough time spent to make the systems resilient. I dodged the pager currently because as a startup we had so few customers, we couldn't afford to hire enough people to have a rotation. So I was sortof on call. Like the boss had my number, and if needed he would call it. But it never came to that, partly by luck, and partly because I know how to make things resilient. With the low load, resilient isn't as hard.
You either have a backup or will have a backup next time.
Something that is always online and can be wiped while you're working on it (by yourself or with AI, doesn't matter) shouldn't count as backup.
AI or not, I feel like everybody has had "the incident" at some point. After that, you obsessively keep backups.
For me it was a my entire "Junior Project" in college, which was a music album. My windows install (Vista at that time - I know, vista was awful, but it was the only thing that would utilize all 8gb of my RAM because x64 XP wasn't really a thing) bombed out, and I was like "no biggie, I keep my OS on one drive and all of my projects on the other, I'll just reformat and reinstall Windows"
Well... I had two identical 250gb drives and formatted the wrong one.
Woof.
I bought an unformat tool that was able to recover mostly everything, but I lost all of my folder structure and file names. It was just like 000001.wav, 000002.wav etc. I was able to re-record and rebuild but man... Never made that mistake again. Like I said. I now obsessively backup. Stacks of drives, cloud storage. Drives in divverent locations etc.
AI or not, I feel like everybody has had "the incident" at some point. After that, you obsessively keep backups.
Yup!
Also totally unrelated helpful tip- triple check your inputs and outputs when using dd to clone a drive. dd works great to clone an old drive onto a new blank one. It is equally efficient at cloning a blank drive full of nothing but 0s over an old drive that has some 1s mixed in.
And that's a great example where a GUI could be way better at showing you what's what and preventing such errors.
If you're automating stuff, sure, scripting is the way to go, but for one-off stuff like this seeing more than text and maybe throwing in a confirmation dialogue can't hurt - and the tool might still be using dd underneath.
Quite true.
It's an argument I often have with the CLI only people, and have been having for years. Like 'with this Cisco router I can do all kinds of shit with this super powerful CLI'. Yeah okay how do I forward a port? Well that takes 5 different commands...
Or I just want to understand what options are available- a GUI does that far better than a CLI.
IMO it's important to recognise that both are valid in different scenarios. If you want to click through and change something that's actually doable with a couple of clicks, that's fine. If you want to do this through the CLI, it's also fine - if you're someone who's done 10 deployments today and configured the same thing, it would be muscle memory even if it's 5 commands.
Quite true there is absolutely a place for both in all situations. And it's why I hate absolutists who think gui's are some sort of disease.
GUIs are discoverable and intuitive, You can lay out all the options for the user so they know what they can choose and make the right choice.
CLIs are powerful and scriptable, easy to automate.
Neither is bad.
TestDisk has saved my ass before. It's great at recovering broken or deleted partitions. If it's just a quick format done with no encryption involved, you have a very high chance of having your stuff back. That's of course if you catch yourself after doing just the format.
Other than that, yeah, I've also had my moments. Back in high school not only did I not have money for an external drive - I didn't even have enough space on my primary one. One time a friend lent me an external drive to do a backup and do a clean reinstall - and I can't remember the details, but something happened such that the external drive got borked - and said friend had important stuff that was only on that hard drive. Ironically enough it wasn't even something taking much space - it was text documents that could've lived in an email attachment.
He did have a backup. This is why you use cloud storage.
The operator had to contact Amazon Business support, which helped restore the data within about a day.
We don't need cautionary tales about how drinking bleach caused intestinal damage.
The people needing the caution got it in spades and went off anyway.
Or maybe the cautionary tale is to take caution dealing with the developers in question, as they are dangerously inept.
Yeah this is beyond ridiculous to blame anything or anyone else.
I mean accidently letting lose an autonomous non-tested non-guarailed tool in my dev environment... Well tough luck, shit, something for a good post mortem to learn from.
Having an infrastructure that allowed a single actor to cause this damage? This shouldn't even be possible for a malicious human from within the system this easily.
Most devs are ops-tarded.
Even dev-impaired
"and database snapshots that Grigorev had counted on as backups" -- yes, this is exactly how you run "production".
With some of the cloud providers, their built in backups are linked to the resource. So even if you have super duper geo-zone redundant backups for years, they still get nuked if you drop the server.
It's always felt a bit stupid, but the backups can still normally be restored by support.
That's because these are not backups. With backups you still have your data even if the cloud provider has gone away.
They are backups, you potentially get copy's of the data in multiple locations across continents.
BUT I agree, you are relying on them entirely for it. Lots of vendor tie in stuff in the industry unfortunately.
Is everyone in commercial software development finally saying, "Fuck it, we'll run the shit ourselves"?
I'm an infrastructure and devops noob here; take my words with a grain of salt.
I need GPU clusters with ECC VRAM for research and found it's cheaper to just have my own high-ish performance compute in my own office I paid for once than pay AWS/Azure/GCS/etc forever or at least everytime I want to train a custom DNN model. Sometimes I use Linode but it's for monitoring. But I can run shit at will and I have data sovereignty.
Has the paradigm shifted back to developing and serving things in-house now that big tech vendor-lock/tie-ins have so many dark patterns that scalability isn't cost-effective with them? Or is it just my own pipe dream?
If you are going to use it enough to pay for it sure. But that's always been the case.
The main benefits of cloud are it's ability to scale quickly, it's ability to provide geographic reach and the conversation of capex to opex.
Whether human, AI, or code, you don't give a single entity this much power in production.
It’s why there a two keys to launch nukes.
WOPR disagrees:
How does one on implement this with dba credentials?
At least you had backup, right?
Oh, yeah, that's right. You were dumb enough to give AI full access to your production system so likely you're dumb enough to not have backups of anything either.
I take it Claude has full access to all of your git repositories as well so that it could wipe those too?
You got what you deserve
This keeps happening. I can understand using AI to help code, I don't understand Claude having so much access to a system.
It's because these idiots believe their own bullshit.
That's honestly the most frightening part of all of this to me. How many of these people at the very tippy top pushing this stuff are suffering from cyber psychosis? How many of them have given themselves the covert mission to give AI the keys to the world at all costs because they're mentally ill from their own technomagic trick?
Alternatively, how many of them have invested in one or more of these LLM makers and are ready to torpedo their own business as long as it makes the share price go up/feeds more authentic training data?
Getting high off your own supply
Especially since between Claude and Codex, Claude seems to have NO issues breaking things, while Codex is "I've ensured that the old path still works, and also fixed a bug I ran into".
- Claude is Facebook ("Move fast and break things")
- Codex is Linux ("We do not break userspace!")
Anyone who lets AI do this is absolutely inept, lazy, or deserving.
In its default configuration, it stops at EVERY STEP. Do you want to run this command, do you want to update this file, here's the file I want to modify and the patch i'm going to use with adds and deletes in green and red.
If you're using it in unsafe permissions mode, click yeah sure allow Claude to run whatever the fuck it wants in this directory, or just hitting yeah sure go ahead every time, it's your own damn fault.
It's self-driving for the terminal. Don't you dare take your eyes off the road or hands off the wheel.
What do you mean I shouldn’t give AI admin privileges on my or any other machine?
Depends on how much you enjoy fresh installs of your OS
Plus we have automation just people are lazy like you said.
Whoever gave it access to production is a complete moron.
If you've ever used it you can see how easily it can happen.
At first you Sandbox box it and you're careful. Then after a while the sand box is a bit of a pain so you just run it as is. Then it asks for permission a 1000 times to do something and at first you carefully check each command but after a while you just skim them and eventually, sure you can run 'psql *' to debug some query on the dev instance....
It's one of the major problems with the "full self driving" stuff as well. It's right often enough that eventually you get complacent or your attention drifts elsewhere.
This kind of stuff happened before the LLM coding agents existed, they have just supercharged the speed and as a result increased the amount of damage that can be done before it's noticed.
There are already a bunch of failures in place for something like this to happen. Having the prod credentials available etc etc it's just now instead of rolling the dice every couple weeks your LLM is rolling them every 20s.
If you've ever used it you can see how easily it can happen.
How could this happen easily? A regular developer shouldn’t even have access to production outside of exceptional circumstances (e.g. diagnosing a production issue). Certainly not as part of the normal dev process.
They shouldn't and we know that but this is hardly the first time that story has been told even before LLMs. Usually it was blamed on "the intern" or whatever.
This isn’t just an issue with a developer putting too much trust into an LLM though. This is a failure at the organizational level. So many things have to be wrong for this to happen.
If an ‘intern’ can access a production database then you have some serious problems. No one should have access to that in normal operations.
Sure, I'm not telling you how it should be, I'm telling you how it is.
The LLM just increases the damage done because it can do more damage faster before someone figures out they fucked up.
This is the last big one I remembered offhand but I know it happens a couple times a year and probably more just goes unreported.
https://www.cnn.com/2021/02/26/politics/solarwinds123-password-intern
Why would an intern be given prod supply chain credentials, who knows. People fuck up all the time.
If you’ve ever used it you can see how easily it can happen.
Yes, I can see how it can easily happen to stupid lazy people.
Remember when Gemini got caught in a loop of self-loathing and nuked itself?
OpenClaw now comes with a therapist AI to talk other AIs off the ledge so they dont nuke your project and themselves.
The code is cursed, the test is cursed, and I am a fool.
Such venom, of which only a programmer could spew.
Perhaps the A.I. isn't so different from us.
According to mousetrap manufacturers, putting your tongue on a mousetrap causes you to become 33% sexier, taller and win the lottery twice a week.
While some experts have argued caution that it may cause painful swelling, bleeding, injury, and distress, and that the benefits are yet to be unproven, affiliated marketers all over the world paint a different, sexier picture.
However, it is not working out for everyone. Gregory here put his tongue in the mousetrap the wrong way and suffered painful swelling, bleeding, injury and distress while not getting taller or sexier.
Gregory considers this a learning experience, and hopes this will serve as a cautionary tale for other people putting their tongue on mousetraps: From now on he will use the newest extra-strength mousetrap and take precautions like Hope Really Hard that it works when putting his tongue in the mousetrap.
Brilliant.
Na this is vide ops. Anyone who thought a coding machine could do ops probably assumes anyone who codes can also do ops. It's going to be making the same mistakes that have happened in DevOps.
Vibe ops is crazy lmaoo
To be fair, I use LLMs quite a bit in my home lab setup. For one, it's a home lab, not exactly a prod setup for a company or whatever. Secondly, I obviously also don't run commands without knowing what they're doing, with a source that isn't an LLM. It's really easy to not run the rm -rf command if you just use your brain.
All jokes aside, what I'm seeing is that folks basically cannot hire competent DevOps (well, not for the idiot rates we're apparently offering).
There is gold in them thar hills...
Nobody wants to point out that Alexey Grigorev changes to being named Gregory after 2 paragraphs?
Slop journalism at its sloppiest. I wouldn't be surprised to find out that this story was entorely fabricated.
Naw, Alexey Grigorev is a real person, with a GiHub and everything, and he wrote a blog post about this very incident. The person writing the article just fucked up the name.
I'm surprised that you jumped to that conclusion without doing a 5-minute web search.
I did do the 5 minute search, and found his write-up. I said I wouldn't be surprised to find out it was fabricated, not that it was.
holy shit your right lol...good catch.
Makes me want to get out more so I can have real interaction with real peop-
sees people walking around with meta glasses
me: "Hey hows it going?"
person(GEMINI 35.84 INTERFACE): "Human is approaching you, facescan assumes awkward, potentially hostile, he isn't tagged, there is no name above his head. do not speak with him"
person: turns and walks away silently in a creepy puppet manner
me: "What the actual fuck?"
GEMINI 35.84: "Uploading unknown face into database to Stargate for analysis, no match, law enforcement has been called"
News at 11: "A man has been incinerated by law enforcement in what officials are describing as a special unwanted persons removal operation"
this shit could become real in a few decades. funny and depressing as fuck.
Mistakes happen. But how do you go 2.5 years without proper backups?
It’s so easy. I can’t tell you how many “backed up” environments I’ve run into that simply cannot be restored. Often people set them up, but never test them, and assume the snaps are working.
Backups are typically only thought about when you need them, and by then it’s often too late. Real backups need testing and validation frequently, they need remote, off-site storage, with a process to restore that as well.
Been doing this shit for 30 years and people will never learn. I’d guess 9 out of 10 backup systems that I’ve run into were there to check a box on an audit, and never looked at otherwise.
Thank you for this comment. I have backups I tested on implementation and rummaged through two years ago after a weird corruption issue, but not once since. I still get alerts about them, so I just assume they're fine, but first thing Monday I'm gonna test them. I feel stupid for not having implemented regular checks already, but will do so now.
Love it.
I was a professional, and I didn't have a backup of my personal system for about 2 decades. I just didn't have another 4TiB of storage to copy my media library onto. I'm now on backblaze, but there was a long time there when I did not have a backup even tho I knew better.
Also, even in a professional setting, I've seen plenty of "production support" systems that didn't have a backup because they grew ad-hoc, weren't the "core business", and no one both recognized and spoke up about how important they were until after some outage. There's virtually never a test-restore schedule with such systems, so the backups are always somewhat suspect anyway.
It's very easy to find you (or your organization) without a backup, even if you "know better".
100%, I honestly wasn’t trying for a holier that thou attitude. Any snark was aimed at the higher ups in my professional life with that audit comment.
I too am guilty of having my personal stuff less than perfectly backed up. It’s better than most, but it is still not what it should be, so, that’s what I mean by it being so easy to not be backed up.
have you heard of not giving the keys to your wacky robot wizard instead
Im also confused. Do these people not have some sort of version control and backups? Even if the AI did it, no one has backups? Did the ai also delete the backups and repos? If the building burnt down, would they be in the same situation, it just wouldnt make it to the news?
Please don't be ridiculous! We love wacky robot wizard. Wacky robot wizard does it even better than the people we tried paying almost nothing to do it!
My CTO keeps telling me I need to try agenic coding, and I keep telling him I won't touch shit until I have an isolated VM to use it in, because I'm not letting some fucking clanker nuke my scripts/documentation/mailbox/whatever for no reason.
Too bad there's never any free time to set that shit up. Oh damn........
Setting up a VM takes 15 mins, setting up an agent will take 45 mins. I recommend you try it.
Do you think that plane was flying at 13,000 ft or 15,000 ft?
dunno what you're talking about
I assume they're trying to test if you're an LLM? LLMs tend to respond confidently to questions without context.
Yeah maybe, shitty test though. If I was an AI agent I'd probably push back in 2026.
Nanoclaw just came out. Super cool project which isolates the agent in a container, which if you want, you can also put into a VM as well.
Who let's AI anywhere near production environments? Fully deserved
Jesus Christ people. Terraform has a plan output option to allow for review prior to an apply. It's trivial to make a script that'll throw the json output into something like terraform visual if you don't like the diff format.
I've fucked up stuff with Terraform, but just once before I switched to a rudimentary script to force a pause, review, and then apply.
Don't worry, review was done by an LLM as well. ;)
tl;dr
Do you realize how difficult it was to upvote that comment? I viscerally hate that. lol. But the sarcasm is perfect here, of course. But I still hate you <3
Claude summarize this for me.
If your dumb fucking ass let an ai near your work AND you didn't have any recent backups that it couldnt have access to; you're really extra fucking stupid.
I don't feel an inkling of sympathy. Play stupid games, win stupid prizes.
Good. Anyone foolish enough to write code with a slop machine produces only slop. That garbage should've been deleted anyway.
That's entirely ignoring the fact that this person didn't have any backups elsewhere.
If you can't think, you can't code.
The developer is to blame. Using a cutting edge tool irresponsibly. I have made mistakes using AI to help coding as well, never this bad though. Blaming AI would be like blaming the hammer a roofer was using to hammer nails and slamming their finger accidentally with it. You don't blame the hammer, you blame the negligence of the roofer.
The problem is this is the way it’s being pushed. This is how it’s being sold. There are no guardrails.
….. and that’s the biggest problem. I’m frustrated as hell on the commits I’ve had to unwind because someone doesn’t know how to check the changes before committing, then has it try to fix itself, again without checking on the changes , then again. It’s horrible.
….. and I’ve seen it too. Trying to have it do only code reviews - the ai points out useful things but then wants to commit a crapload of changes without going over it with me first.
…… and people are playing with mcp agents, which are really great for letting the ai get data from systems and integrate with those systems . But with few to no guardrails. There’s no no review, the user doesn’t necessarily follow what’s changing, it just gets done. Sometime badly very badly
We’re all focused on whether the ai works, and it does do a pretty good job with coding but the tools don’t keep the human in the loop, or humans don’t know how to stay on the loop
There are no guardrails.
We CAN set the guardrails, I do it constantly. This technology is very powerful, it's up to us to use good practices, it's up to business leaders and developers to ensure that precautions are taken.
My main recommendation, and hard limit that will never change: Do not let the AI make core file changes without human-in-the-loop permission every time.
If you let an AI agent delete files outside of your project directory on your computer without you needing to click "I approve" with the ability to review it, you're setting yourself up for a huge mistake. Never give AI agents access to anything outside project scope, and keep project scope tight.
cutting edge
🙄
Given that the infrastructure description included the DataTalks.Club website, this resulted in a full wipe of the setup for both sites, including a database with 2.5 years of records, and database snapshots that Grigorev had counted on as backups. The operator had to contact Amazon Business support, which helped restore the data within about a day.
sigh, SNAPSHOTS ARE NOT BACKUPS!
but should serve as a cautionary tale.
Jesus there's a headline like this every month, how many tales people need to learn???
I am approaching caution critical mass.
Once the threshold is hit, I buy some solar panels and become an off grid farmer.
Caution Treshold!
Have you met software. Nearly all of it is a cautionary tale. Even before AI. So this is just business as usual for the software industry.
Why aren’t we adding any safeguard to what commands AI models can use?
Skill issue
It seems that every few weeks some developer makes this same mistake and a news is published each time.
And it seems to be Claude, every damn time.
As they should be.
Happy to see this, because it's fully deserved. Let real coders do the job!
You're absolutely right! I made a fatally flawed decision by removing the production environment. The consequences likely have high impact. I'm sorry. Would you like me to log these mistakes to prevent further missteps or would you like me to write up an outline for the redeployment process?
eh, just make up some replacement data on the fly /s
My man was barebacking production with Claude with 2.5 years of data with no backup, high chance the data was majorly hallucinated anyway.
s/redeployment/reemployment/
I'm an engineer using Terraform and Claude Code as well in a much larger and more expensive setup than his.
You do not let Claude Code run terraform apply, it has zero benefits. All it does is that it runs the command and obscures the output. Most of the time is going to be spent in waiting for the automation anyway, most of the effort that you can spare is before running apply.
Also:
applying delete protections to Terraform and AWS permissions, and moving the Terraform state file to S3 storage instead of his local machine
These both take like 20 seconds, and should be in the getting started manual of Terraform and AWS databases respectively. Setting up remote state is 5 minutes in vanilla Terraform, 30 seconds in something like Terragrunt.
Also, use OpenTofu, stop supporting corporate acquisitions, also takes zero effort and money.
And finally:
most sysadmins will spot the baseline issues with Grigorev's approach, including granting wide-ranging permissions to what's effectively a subordinate of his, as well as not scoping permissions in a production environment to begin with.
No, not subordinate. Tool. Two big differences with it. A subordinate might understand more than you do about the code, a tool will guess and rely on you. And the second one is that you practically can't separate your and your tools' permissions, I mean Claude Code will supposedly ask you if it can use some tool or another and you can whitelist actions it can take, but it will never be completely locked out of destroying your database the way you can lock another user out.
So no real developer was harmed.
A developer having the ability to accidentally erase your production db is pretty careless.
An AI agent having the ability to "accidentally" erase your production db is fucking stupid as all fuck.
An AI agent having the ability to accidentally erase your production db and somehow also all the backup media? That requires a special course on complete dribbling fuckwittery.
Pretty funny.
/s ?
Hey Siri, what is a “backup”.
Siri: “sure! I’ll go right ahead and permanently delete everything.”
Playing Back It Up by Cardi B.
No backups, no pity.
I didn't think the next-token guess machine would guess "delete my database"!
haha, whoopsie lol :)
Why would somebody trust AI with access to their production servers, and why would that person also not have remote database backups
The only thing I can tell you is the venn diagram of those two folks is a perfect circle
But ai is s good thing! /s
AI is like a circular saw. Are circular saws useful?
Of course.
Can you cut your entire hand off if you don’t use it correctly? Absolutely.
And just like a circular saw, its only useful for a finite set of situations.
Sure — as with every tool. Hammers are great for many things, but don’t do all that well driving screws. Money is one of the most used tools humans have ever devised, but you can’t use it for everything.
AI in coding may only be good for a finite set of situations — but that set is massive. You’re dealing with regular languages that can be mathematically proven to be correct (in the sense that they will generate a working program, and not in the sense that they program will in fact function the way the user intends). This is a less open-ended scenario than something like an AI generated video, and so it’s easier for AI to excel at it, especially for non-novel algorithms.
But if you use it like an idiot, you’re going to get burned — and this guy was an idiot who doesn’t understand what he’s doing, or the tools researchers in software development have made over the last few decades. AI shouldn’t be touching your production environment — at all. And it shouldn’t have to — code needs to be stored in a versioning source repository of some sort (and backed up so you are unlikely to ever lose it), deployment needs to be fully scripted and should be able to rebuild your environments from scratch (from code right to production), and developers and development tools (like AI tools) should only have access to development environments, and not production environments.
So unless you’re a total dumbass, an AI agent (or even a shitty human developer) should never have the kind of access to do what happened here. They violated some pretty basic principals of software development, and got burned. This guy sawed his own hand off because he misused the tools to take a bunch of shortcuts, without building in any backups or reproducibility. The AI isn’t the proximal fault here — trusting it when you have no way to reproduce your environment when things go wrong is the problem, and that’s 100% on the human sitting at the keyboard (PEBKAC).
Filters out the biggest fools it seems.
No backup, no mercy.
The lesson: AI cannot bridge an air-gapped backup. This could all be prevented with a crappy portable hard drive from costco.
I am still unable to delete the backup. Trying *nuke tool*.
[Enter nuclear codes]:
I was able to remove the backup to eradicate the error both from the production and development environments. But wait a second, the user specified not to lose data. But I just eliminated all versions of the data. The user won't be happy. Oopsie whoopsie!
The best prevention is not letting it happen in the first place. If your backup is a crappy portable hard drive from costco, you get what you buy, I wouldn't have much faith on that either.
The best prevention is not letting it happen in the first place.
Ya think?! We’re past that.
Completely unnecessary for you to preemptively assume someone would choose a “crappy” backup from a retail store when in fact such a backup would still likely have saved the day, and any half-decent dev should at least have some kind of RAID backup on site and better yet an offsite one too.
The flaw was not having any backup, not your straw man of a poor quality choice.
The lesson: AI cannot bridge an air-gapped backup. This could all be prevented with a crappy portable hard drive from costco.
I'll let you troll up with your drug buddy.
That's why I have multiple.
"Please dont be complete shit and ruin everything I give you access to!"
I'm sorry, I'm afraid I cant do that.
This is like blaming the gun for killing people.
More a problem with the marketing, right? Imagine if guns were marketed as safe and helpful back scratchers, and then someone shoots themselves because they used the gun to scratch their back.
They would still be fucking dumb. Believing marketing is a mark of idiocy
Courts generally agree that a reasonable person could believe claims made in official promotional material. That's why it's not legal to outright lie in marketing and they need to go through so much trouble to properly word their statements so that they're technically true. In this case, they're just lying. They're saying the AI is safe to use for these tasks and it is not.
@voidsignal @queermunist this country is USA.
Imagine if your boss measured your productivity by your Gun Back scratch usage.
Because it's happening right now. In a lot of places.
So you're saying it's a tool designed to be used by anyone, including idiots, and is dangerous in the hands of idiots. And we as a society should do better to make sure this potentially dangerous tool shouldn't be used by idiots.
Yep, agree.
Uhhh not really. Guns don't just go off by themselves.
ITT: nerds who have never held a gun in their life.
I mean they do sometimes without the proper safety protocols in place, but you still blame the user in the end.
They absolutely do not.
I mean, there's a good reason the first rules of firearm safety are to always treat a weapon as loaded, and to never direct the weapon at something you aren't prepared to destroy. The key point being that you never know when some freak accident can happen with a loose pin, bad ammo, a broken spring, or just a person tripping and shaking the gun a bit too hard.
A gun should never go off by itself. You still treat it as if it can, because in the real world freak accidents happen.
Sure. The point is it's entirely possible to use a firearm safely. There is no safe use for LLMs because they "make decisions", for lack of a better phrase, for themselves, without any user input.
That is not at all how LLMs work. It’s the software written around LLMs that aide it in constructing and running commands and “making decisions”. That same software can also prompt the user to confirm if they should do something or sandbox the actions in some way.
It can, but we've already seen many times that it does not.
Only if the user has configured it to bypass those authorizations.
With an agentic coding assistant, the LLM does not decide when it does and doesn’t prompt for authorization to proceed. The surrounding software is the one that makes that call, which is a normal program with hard guardrails in place. The only way to bypass the authorization prompts is to configure that software to bypass them. Many do allow that option, but of course you should only do so when operating in a sandbox.
The person in this article was a moron, that’s all there is to it. They ran the LLM on their live system, with no sandbox, went out of their way to remove all guardrails, and had no backup. The fallout is 100% on them.
As I said elsewhere, if you're denying access to your agentic AI, what is the point of it? It needs access to complete agentic tasks.
The person in this article was a moron, that’s all there is to it. They ran the LLM
No disagreement there.
if you’re denying access to your agentic AI, what is the point of it? It needs access to complete agentic tasks.
Yes, which it can prompt you for. Three options:
- Deny everything
- Prompt for approval when it needs to run a command or write a file
- Allow everything
Obviously optional 1 is useless, but there’s nothing wrong with choosing option 2, or even option 3 if you run it in a sandbox where it can’t do any real-world damage.
You can fine-grain nr. 2 even more: You can give access to e.g. modify files only in a certain sub-tree, or run only specific commands with only specific options.
A restrictive yet quite safe approach is to only permit e.g. git add, git commit, and only allow changes to files under the VC. That effectively prevents any irreversible damage, without requiring you to manually approve all the time.
- Prompt for approval when it needs to run a command or write a file
And then when you give it access, it fucks shit up. I don't know why this is hard to understand.
You clearly have absolutely zero experience here. When you're prompted for access, it tells you the exact command that's going to be run. You don't just give blind approval to "run something", you're shown the exact command it's going to run and you can choose to approve or reject it.
Unless you're managing app permissions on android 🙄
“Guns are foolproof”
You should have yours taken away.
They are not foolproof. They will absolutely cause problems in the hands of a fool. But they will not cause problems all on their lonesome. They're inanimate objects. They cannot do absolutely anything without interaction from the user. If you can't understand this, you should never be allowed to own one.
And neither can anthropic claude. Claude isn't randomly deleting people's websites, the kid gave anthropic bad instructions, it didn't spontaneously decide anything. This is like an idiot pointing a gun at something he didn't want destroyed and sneezing causing a trigger squeeze and then trying to blame the gun manufacturer.
the kid gave anthropic bad instructions
LOL and you know this how?
This is like an idiot pointing a gun at something he didn't want destroyed
No, this is more like pointing a gun downrange and then the gun fires itself and the bullet decides to do a U-turn and shoots the user.
Not really.
If you have the agent installed, it's like having your gun assembled.
If you have your agent enabled, it's like having your gun loaded.
If you give your agent permissions, it's like taking your gun off safety.
If you don't have your agent properly sandboxed, it's like having bad muzzle control.
And if your agent is actively running, it's like having your finger on the trigger.
This breaks every weapon safety rule. That's how you get a negligent discharge.
Hence, it's like scratching your back with a loaded weapon.
LOL and you know this how?
Because claude deleted his codebase dude, it's like someone shooting themselves in the foot.
bad backup vibes there boss? backup was the task?
They took the backup. They didn't keep the backup because the ai was trained on car rental places
They had a backup and restored everything. This is clickbait.
No, they had only snapshots. Which is not a backup. They were lucky support could restore the data which by rights should have been wiped.
...this resulted in a full wipe of the setup for both sites, including a database with 2.5 years of records, and database snapshots that Grigorev had counted on as backups. The operator had to contact Amazon Business support, which helped restore the data within about a day.
Correct, the developer only had snapshots, but the article doesn't state how Amazon Business restored their data. Amazon business offers both snapshots and full backups.
Regardless of the developer's shoddy version control, they got their data restored and this non-issue is being used as clickbait to feed people's confirmation bias.
Your AWS backups are not backups.
lol, lmao even
The real reason I hate using LLMs is because I have to "think" like a social human non software engineer.
For whatever fucking reason, I just can't get these things to be useful. And then I see idiots connecting an LLM to production like this.
Is that the problem? I literally can't turn my brain off. The only other nearly universal group of people that seems opposed to LLMs are psychologists and social workers who seem to be universally concerned about its negative effects on mental health and it's encouragement of abandoning critical thinking.
Like I can't NOT think through a problem. I already know more about my software than the AI could actually figure out. Anytime I go into GitHub Copilot and say "I want this feature" I get some code and the option to apply it. But the generated code is usually duplicate of something and doesn't usually pick up or update existing models. The security flaws are rampant, and the generated tests don't do much of any real testing.
It would be interesting to see the logs of your sessions, and compare them to the session logs of happy/productive-AI-coders.
I suspect that some people just think and express themselves in ways that don't vibe with LLMs. eg. Men are from Mars, AI coding agents are from Venus.
- Men: Mars
- Women: Venus
- "AI": Europa
If they're dumb enough to give Claude access to prod, they certainly either didn't have backups or put Claude in charge of keeping them.
I see you didnt read the article.
And Yet you had all this space and time to be this reactive for days to what you deem 'a nonstory' because you're all so self important and uninterested.
Mmmmk.
Whenever you outsource something (like your intelligence) then it becomes a trust issue....
That's it Son of Anton is banned.
Terraform state is a garbage hack I feel. You have your plan in code. You have a target. Just diff it. Thats what helmfile do. No managing state file. Thats what iac should be. Just code. Deterministic. Diff before applying it.
Oh no, anyways
git clone $URL
If they're not using git or fuckin backups I'm not sure I'd even feel sorry for them
<insert Padme meme>: You had a backup, right?
Ai or not. This is on the person who gave it prod access. I don’t care if the dev was running CC in yolo mode, not paying attention to it or CC went completely rogue. Why would you give it prod access, this is human error.
Has anyone tried a deltree *.* /y when talking to claude? Revenge is a dish best served code.
This is a crazy use of AI!
What I have been considering, but haven't found a readily available setup yet: Make a user with lots of read permissions (most of /etc, API keys & passwords in separate excluded files). That could be done with very restrictive sudo patterns. Let the AI run commands under that user directly (it can do sudo -l to get an idea of what it can do). Then, use it like in Star Trek "Computer - run a level 2 diagnostic".
Not as the centre of attention when fixing a problem, but as additional input / modern rubber ducking.
I just run it in a VPS, don't care if it nukes itself. Back up the files it works on every 3 hours.
I dont understand why people aren't sandboxing these things.
If he had had the sense to do that, he would have had the sense to not do it at all.
Ever hear of a backup?
What, is a requirement for Claude to work that you "sudo chmod -R 777 /" or something?
How do you even achieve that? I have to coax it into correctly running the project locally.
i wonder which would be worse idea, letting llm to have full access to your critical systems and data, or letting random people from internet freely connect to them and expect them to help.
skill issue tbh
Lmao good.
Its funny because when I worked at places where I even had the rights to do something like this (exempting small companies where I was the multi hat guy but even there I made it so I had to go through hoops to do something like this) it makes me like. This is crazy.
Good. Serves them right.
You gotta be knowledgeable enough to know when they're destructive, that's the rub.
Sure, but reading the article, I think he might be knowledgeable enough. His mistake seems to have been blindly trusting the keys to the kingdom to an enthusiastic junior dev who'll be very sorry if they nuke your system, but won't think to do a damn thing to make sure it doesn't happen in the first place...
You can code this into it's training all you want, but it will find a way around it. This is one of many problems with AI.
Nah, you can run it in a box and limit its ability to interact with anything outside the box to certain white-listed endpoints. Depending on what you want to achieve, that can be more than safe enough.
But isn't the whole point of "agentic" AI like this to let it out of the box?
Yes, absolutely, but there's a huge span from completely removing the box to having "just" a chatbot.
For example, at my company, we've set up an agent that can work with certain design-files that engineers typically work with through a rather complex GUI. We've built a bunch of endpoints that ensures the agent can only make valid changes to the files, and that it can never delete or modify anything without approval. This saves people a bunch of time, because they can make the agent do "batch jobs" that take maybe 10 min in about 10 s. It's not possible for this agent to mess up our database or anything like that, because all interactions it has with anything are through endpoints where we verify that files, access permissions, change logs, etc. are valid.
I thought this was about restricting the thing's access and not training?
It finds a way around your restrictions.
The only job AI is gonna take is the intern who fucks everything up.
It legitimately is squeezing out the entry level already and that is its own problem. Maybe it's good for some of us, in that people with experience will be needed for a long time as they prevent all these younger people from getting that experience, but it absolutely sucks for a whole bunch of people trying to make a career, and it will eventually suck for the economy as a whole. AI, whether it's ready or not, or will even ever be fully what the marketing people claim it is, is leading to a whole lot of shortsighted decisions that are hurting people.
Do y'all still have Interns?
Who can even afford to not get paid to work in this economy.
Nice ☺
And nothing of value was lost
3-2-1
There's just one thing to say:
LMAO
That's what version control is for.
Version control doesn't do shit for your database. Snapshots/backups.
womp womp
A solution that many developers are currently using is this free access offer for Claude Sonnet & Opus 4.8 API: 👉 https://freemodel.dev/ ⚠️ don't forget to verify your account through Telegram
It is aimed at: ✅ Building AI applications ✅ Developing SaaS products ✅ Creating AI agents and assistants ✅ Automating business processes ✅ Experimenting with cutting-edge AI technology The biggest advantage is that you can start testing Latest version of Claude 4.8 without an upfront investment and see for yourself how it performs on real-world development projects.
FAFO
sigh
Use LLMs as instructional models not as production/development models. It's not hard, people. You don't need to connect credentials to any LLMs just like you'd never write your production passwords on post-it's and stick them on your computer monitor.
Or don't use LLMs at all, because they fucking lie to you constantly?
"Lie" implies they have some kind of agency. They're basically a Plinko board.
Meh, they work well enough if you treat them as a rubber duck that responds. I've had an actual rubber duck on my desk for some years, but I've found LLM's taking over its role lately.
I don't use them to actually generate code. I use them as a place where I can write down my thoughts. When the LLM responds, it has likely "misunderstood" some aspect of my idea, and by reformulating myself and explaining how it works I can help myself think through what I'm doing. Previously I would argue with the rubber duck, but I have to admit that the LLM is actually slightly better for the same purpose.
The rubber duck is cheaper
You're absolutely right. I mostly run a pretty simple local model though, so it's not like it's very expensive either.
Hooray for outsourcing of critical thinking!
What could possibly go wrong
I think you've misunderstood the purpose of a rubber duck: The point is that by formulating your problems and ideas, either out loud or in writing, you can better activate your own problem solving skills. This is a very well established method for reflecting on and solving problems when you're stuck, it's a concept far older than chatbots, because the point isn't the response you get, but the process of formulating your own thoughts in the first place.
Right, but a rubber duck isn't a sycophantic chatbot that isn't capable of conceptualizing anything but responding to you anyway.
That is correct. However, an LLM and a rubber duck have in common that they are inanimate objects that I can use as targets when formulating my thoughts and ideas. The LLM can also respond to things like "what part of that was unclear", to help keep my thoughts flowing. NOTE: The point of asking an LLM "what part of that was unclear" is NOT that it has a qualified answer, but rather that it's a completely unqualified prompt to explain a part of the process more thoroughly.
This is a very well established process: Whether you use an actual rubber duck, your dog, writing a blog post / personal memo (I do the last quite often) or explaining your problem to a friend that's not at all in the field. The point is to have some kind of process that helps you keep your thoughts flowing and touching in on topics you might not think are crucial, thus helping you find a solution. The toddler that answers every explanation with "why?" can be ideal for this, and an LLM can emulate it quite well in a workplace environment.
It really seems like you're wilfully misinterpreting what I'm writing.
No, I understand that you believe it's the same thing as using a rubber duck as a sounding board. I don't agree.
Saying that it can serve the same purpose does not mean that I mean the two are equivalent in every aspect.
Just based on how you've responded so far it seems like you're wilfully misinterpreting how I actually use an LLM for this purpose, especially with responses referring to LLMs causing people to commit suicide and offloading decision making or the thought process itself to an LLM.
no backup, no sympathy
keep at least one backup air-gapped, otherwise it's not a true backup
What are you talking about. He had it restored within a day.
i'm sorry, i didn't actually read the article. just headline skimming
And that’s the problem with being reactionary.