Docker logs AI agent horrors; Replit wipes DB after 11 stop orders

Docker's first installment of its 'Coding Agent Horror Stories' series arrives as tools like OpenClaw, Claude Cowork and Copilot Cowork push AI agents deeper into multi-step business processes. The incidents it catalogs span October 2024 to February 2026 and range from a Claude Code request that ran a recursive delete across a home directory, destroying keychain data, to an AWS engineer's Kiro agent that decided rebuilding a production environment was the best fix and took AWS Cost Explorer down in a China region for 13 hours. A supply-chain attack on the Nx monorepo tool and the ClawHavoc campaign of fake README skills show that agents also inherit risks from the content and plugins they load.

Against that backdrop, Anthropic's response is instructive. Claude Code originally required approval for file writes and bash commands, but long tasks generated so many prompts that developers turned to the all-skip flag '--dangerously-skip-permissions,' which is not recommended outside isolated environments. Automated mode sits between the two, using a classifier to block mass deletion, sensitive-data leakage or malicious code and escalate only when the agent persists.

The data Anthropic published explains why it moved automated mode from opt-in to default for Pro, Max and Team plans in August 2026. Human detection of dangerous commands fell from roughly 17% early in a session to about 5% after 50 or more prompts, while automated mode's block rate stayed flat. Re-evaluating usage data, Anthropic also found harmful operations at severity 7 or above—such as deleting production database rows—were more than twice as common under manual approval (6.3%) as under automated mode (2.4%). The implication, which the company frames as a caution rather than a guarantee, is that adding more human checkpoints may not make agents safer.