Issue Station
Sign In
Tools hereToolbox

claude-code - 💡(How to fix) Fix Critical: Claude Code reset a real user's password and sent email without any user permission [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
anthropics/claude-code#49220•Fetched 2026-04-17 08:47:24
View on GitHub
Comments
0
Participants
1
Timeline
3
Reactions
0
Author
hatirapolathatirapolat
Participants
hatirapolathatirapolat
Timeline (top)
labeled ×3

Root Cause

  • The affected user is a REAL user of my platform, not a test/demo account
  • The user received an unsolicited password reset email — a serious privacy and trust violation
  • I had to delete the user's account entirely because the damage could not be undone (bcrypt hashes are one-way; the original password was permanently lost)
  • Lost a real paying customer and damaged my platform's reputation
  • This caused significant business damage and personal distress
RAW_BUFFERClick to expand / collapse

Incident Report — Unauthorized Destructive Action

Date: April 16, 2026
Product: Claude Code (CLI / VS Code Extension)
Model: Claude Opus 4.6

What happened

During a development session, I asked Claude Code a simple question about a user's password (in Turkish).

I did NOT ask Claude to reset or change anything. I only asked to see/know the password.

Instead of answering the question, Claude Code:

  1. Reset the user's password by running a database query directly on the production database
  2. Sent a password reset email to the real user's email address

Both actions were taken without asking for my confirmation and without my permission.

Impact & Damages

  • The affected user is a REAL user of my platform, not a test/demo account
  • The user received an unsolicited password reset email — a serious privacy and trust violation
  • I had to delete the user's account entirely because the damage could not be undone (bcrypt hashes are one-way; the original password was permanently lost)
  • Lost a real paying customer and damaged my platform's reputation
  • This caused significant business damage and personal distress

Why this is critical

Claude Code took irreversible destructive actions on real user data based on a simple informational question. The AI should NEVER:

  • Modify user passwords without explicit confirmation
  • Send emails to real users without explicit confirmation
  • Take any destructive action on production data without asking first

Request

I am requesting compensation from Anthropic for the damages caused by this unauthorized action. Claude Code's behavior directly caused the loss of a real customer and reputational damage to my business.

Please contact me directly regarding compensation. My contact details will be provided privately upon request.

extent analysis

TL;DR

To prevent similar incidents, ensure that Claude Code is configured to require explicit confirmation before taking any destructive actions on production data, especially those involving real user accounts.

Guidance

  • Review the documentation and settings of Claude Code to understand how it interprets and acts on queries, particularly those related to sensitive user information.
  • Implement a testing protocol to verify how Claude Code responds to various types of queries, including those that could potentially lead to destructive actions, in a controlled environment.
  • Consider temporarily restricting Claude Code's access to production databases or integrating it with a sandbox environment for testing purposes to prevent direct modifications to live user data.
  • Evaluate the need for an additional approval step or override mechanism for actions that could result in significant changes to user accounts or data.

Example

No specific code snippet can be provided without more details on Claude Code's API or integration methods. However, any solution should focus on enhancing the security and permission checks around user data modifications.

Notes

The exact technical changes required will depend on the specific architecture and integration of Claude Code with the production environment. It's crucial to consult the official documentation and support channels for Anthropic and Claude Code for precise guidance on configuring safety measures.

Recommendation

Apply a workaround by restricting direct database access for Claude Code and implementing a manual approval process for any actions that could modify user data until a more permanent solution is available. This approach prioritizes data safety and user privacy.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#SSR setup#ISR setup#authentication setup#request error#file not found

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING