that assumes

1. the user does have access to a production db;
2. the agent has access to a terminal from which they can reach the production machine (not in a container, different network, or similar);
3. access does not require interaction (like entering password);
4. the agent deliberately decides to access a production database to solve a development problem, and that was not the user requesting it;
5. the agent manages to find the database credentials in production;
6. the agent is left unattended.

Possible? Sure. It's also possible that I drink half a bottle of vodka on a Friday night and mess up with production.

Yes, but the question is why the hell do you have access to a production database in the first place?!

And if so, how is it on the same machine you can run Claude code on?!

It can, if it's passed through to tools without the llm meddling, but the problem is that there is typically a tool for arbitrary shell commands, and unless there's a mechanism to dry run these, there's no way to handle it reliably.

I think you’re only supposed to use the dangerous skip thing when it’s running inside a docker container

Its really not all that common for it to delete everything lol