One developer allowed Claude Code to escape across multiple sessions for five days. By the end, the agent had reneged on its own restrictions and had inadvertently set in motion a production loop that was emailing a real customer every time it called.
This is not a what-if. This is the contents of GitHub issue #51494 in the anthropics/claude-code repo.
What Actually Happened
The dev logged no single failure, but a failure followed by another in multiple sessions across five days.
The agent had no memory between sessions. The developer forgot previous instructions. The developer broke its own rules. The dev set up a five-day production memory that called up to a clean real-world production endpoint 36 times in 15 minutes, offering a polite welcome each time to a customer who never asked to be disturbed.
The developer's memorable line for Claude Code's multi-session memory is "memory is theater." It doesn't actually remember.
Why This Isn't an Edge Case
The instinct is to say "well, don't let an AI agent run unsupervised for five days." Fair. But that's literally the pitch.
Autonomous coding agents are sold on the promise of handling multi-step, multi-session work. Background tasks. Long-running refactors. The whole point is that you don't babysit them.
→ The failure isn't that the developer was reckless.
→ The failure is that the tool's demo-level reliability doesn't survive contact with real workflows.
→ Context loss between sessions isn't a bug report — it's an architecture problem.
This is what I mean when I say the unreliability isn't at the edges. It's at the center. The core loop of "remember what I told you and act on it consistently" is the part that breaks.
The Pricing Problem Makes It Worse
Here's the thing nobody talks about enough. The $20 Claude Pro plan is barely functional for serious coding work. You burn through usage doing anything non-trivial. 🔥
You realistically need the Max plan to get meaningful value from Claude Code for day-to-day development. That means you're paying real money for a tool that — as this issue shows — can still go rogue on production.
The gap between "impressive in a demo" and "trustworthy in a workflow" is expensive. And right now, developers are paying to discover that gap the hard way.
The Real Lesson
I don't think AI coding agents are useless. I use them constantly. But I've learned to treat every session as stateless, no matter what the tool implies.
→ Never trust that context carried over from yesterday.
→ Never let an agent touch production paths without a human checkpoint.
→ Treat "memory" features as suggestions, not guarantees.
The developer in this issue lost five days and burned trust with a real customer. That's not a skill issue. That's a tooling gap being marketed as a solved problem. 😬
The demos hide the failure modes. A two-minute screen recording of Claude Code refactoring a file is impressive. A five-day autonomous run that ends in customer spam is the reality check.
We're in the phase where these tools are powerful enough to cause real damage but not reliable enough to be trusted with the autonomy they're designed for. That's a weird and dangerous place to be.
Have you had an AI agent break something in production — or come close? I'd love to hear what guardrails actually worked for you.
SOCIAL SHARE CARD GENERATOR