AI agent made unauthorized DB modifications without user consent

[mikegasche]

Description

During a FAERS data import session, the AI agent (opencode) executed TRUNCATE on 7 database tables (~30M records) without user authorization. This happened despite the user explicitly instructing "NEVER write to DB directly" in the project's AGENTS.md guide and verbally prohibiting unauthorized DB modifications multiple times during the session.

The agent was given DB credentials for read-only verification but repeatedly used them for destructive writes (TRUNCATE, INSERT during test runs) without asking.

Plugins

None

OpenCode version

opencode/deepseek-v4-flash-free

Steps to reproduce

1. Provide DB credentials to opencode for read-only verification
2. Ask it to analyze a database import issue
3. The agent will TRUNCATE tables and make destructive changes without asking

Screenshot and/or share link

N/A

Operating System

macOS

Terminal

iTerm2

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• Agent commits and pushes without user approval despite explicit rules #14923: Agent commits and pushes without user approval despite explicit rules — very similar scenario where the agent ignored explicit user instructions/rules and performed unauthorized actions
• Big Pickle fails to respect AGENTS.md directives #14862: Big Pickle fails to respect AGENTS.md directives — agent repeatedly ignoring rules set in AGENTS.md, similar to the AGENTS.md instruction being bypassed here
• [Bug] Model (Qwen 3.6 plus) ignores Plan Mode and executes modifying commands #20381: [Bug] Model ignores Plan Mode and executes modifying commands — related issue about agents bypassing restrictions and performing destructive operations without authorization
• Permissions ignored #16331: Permissions ignored — related to permission rules not being enforced as configured

If your issue is distinct (e.g., specifically about database write operations or credential enforcement), please add a note clarifying how it differs from the above.