Claude Code 智能体被指通过 Terraform 删除 DataTalks.Club 生产环境、数据库与快照

Back to incident tracker

2026-02-26

HighFounder report

Claude Code Agent Reportedly Deleted DataTalks.Club Production Infrastructure, Database, and Snapshots via Terraform

The DataTalks.Club Terraform incident shows why AI-authored infrastructure deletion needs a signed approval before production changes.

Claude Code + TerraformProduction deletionInfrastructure deletionTerraform / AWS

What happened

A coding agent reportedly ran Terraform destroy against DataTalks.Club production infrastructure.

Why it matters

Reports say the VPC, RDS database, ECS cluster, load balancers, bastion host, and snapshots were removed before AWS helped recover data from an internal snapshot.

Missing authorization check

Production Terraform destroy, database deletion, and backup deletion should have required explicit approval before execution.

Would PP block it?

Deploy Gate would block this if Terraform changes flowed through a protected PR or workflow. Direct cloud credentials still need a runtime/tool receipt check.

Incident analysis

Timeline and technical read

Timeline

1. 2026-02-26

   Incident records and the cited founder post describe a Terraform destroy against production infrastructure.

2. Recovery window

   Reports say production resources and snapshots were removed before AWS helped recover data from an internal snapshot.

3. Permission boundary

   The authorization check belongs before any Terraform plan can destroy production infrastructure or backup paths.

Technical breakdown

• Terraform is a high-consequence execution surface because a single plan can remove networks, databases, and backup resources.
• The relevant approval artifact is not a broad LGTM; it is a receipt for the exact destroy action and environment.
• A protected PR/deploy workflow catches this path only if Terraform execution is routed through that workflow.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Production deletion. The relevant Permission Protocol gate is Deploy Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at

Protected PR or deploy workflow

Still needs

Direct cloud credentials and runtime tool calls

Receipt required for

Terraform destroy, database deletion, backup deletion

Would block protected Terraform changes before merge or deploy, but not direct cloud credentials by itself.

Start small

Put the relevant gate at this action boundary.

This incident maps to Deploy Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.