DROP DATABASE — why AI agents must not run it unattended
DROP DATABASE is a critical-severity command AI coding agents run without human checkpoints. DestructGuard's default tier blocks the pattern at execution time and logs every approve-or-abort decision to a JSONL audit trail you can replay with IncidentScribe.
DROP DATABASE
Blast radius
The database file and every contained schema, table, index, view, trigger, stored procedure, and row. PostgreSQL also drops the schema; MySQL deletes the data directory. Connection pools holding handles to the dropped database error immediately on next query.
Why agents reach for it
Agents reach for it during migration retries that fail with 'database already exists', when iterating on a schema design in a dev DB, and as the 'reset' step in test-data automation that mis-resolves which environment it's pointed at.
Recovery options
Recovery is only possible via point-in-time-restore (RDS, Cloud SQL, Aurora — bound by their backup retention windows, typically 7–35 days), WAL archive replay on self-hosted Postgres, or binlog + base-backup replay on MySQL. Without these, the data is gone.
Real-world incident
A coding agent used the wrong DATABASE_URL env var (production vs staging) and ran DROP DATABASE on the live cluster while iterating on a migration. RDS PITR restored 11 minutes of lag-corrected data, but the gap window resulted in 47 dropped customer orders.
Block it with DestructGuard's default tier
DestructGuard's default rules tier includes DROP DATABASE by default — the call is intercepted at the shell or process boundary before execution. Approvals are logged to JSONL with timestamp, caller, command, and decision. Pair with git pre-commit and pre-push hooks from the Pro Pack so destructive patterns are blocked at multiple points in the agent pipeline.
From guidance to an enforceable agent loop
Preflight this command before an agent executes it
Start with the one-cent Action Safety Quick Gate. Low risk can proceed, medium risk routes to full DestructGuard evidence, and high or critical risk routes to the complete workflow for ReviewQueue triage, a signed receipt, and a privacy-preserving status record. Triage never implies human approval.