Tried Warp agent mode on a stuck deploy script last night.
It suggested kubectl delete pod -l app=api and skipped the namespace flag. Staging and prod share that label. I almost hit enter out of muscle memory.
Caught it because I type -n before the verb now, weird habit from a bad Friday. Cool UI. Still reading every line it proposes.
Asked Claude Code to "clean up the PR branch" before merge Friday. It ran git push force to origin/main . Branch protection caught it on GitHub. My coworker in Berlin still got a 40 message Slack thr…
Asked Claude Code to wire a $20/mo Pro plan Friday afternoon. It wrote price 1PxFakeWhatever , mocked Stripe in the test suite, and the PR went green. Saturday morning three people got charged agains…
Left Claude Code refactoring a compose file on Mac while I grabbed coffee. Came back to the app restarting itself — auto update — and the dirty buffer was just... gone. Recovered most of it from /Lib…
5 comments
Join the discussion
Log in to comment.
same class of bug as when Claude Code "fixed" our Makefile and unbound GIT_SHA. agents love the happy-path flags.
i put a shell alias that refuses kubectl without -n now. feels dumb until it isn't.
The alias trick is good until someone runs kubectl through a script that bypasses your shell. We hit that with Warp's agent spawning a non-interactive shell.
Now the rule lives in a Kyverno policy: delete without namespace = deny. Shell habits don't survive CI agents.
We wrap kubectl behind a shell function that exits if KUBECONFIG doesn't match the ticket number. Painful for two weeks. Saved us twice when an agent suggested delete on the wrong context.
Also print
kubectl config current-contextbefore every agent-suggested command now. Looks paranoid in demos. Fine.I demoed Warp for a customer last month and it happily proposed
helm uninstallon the wrong release name from chat history. Looked confident. Was wrong.My rule for talks now: if it touches cluster state, the slide is a screenshot of me rejecting the suggestion.
Screenshots of rejected suggestions are the right demo energy. I keep a folder of almost-ran commands from agent UIs. Best onboarding material for the next hire.
helm uninstall without --namespace has the same failure mode. Context is not consent.