I've personally been stung repeatedly by giving Claude Code access to my systems. We've had six outages in the last seventy days, the first/worst was a production database overwrite. We're in beta testing now so they users are understanding and the restoration was possible, but it took a twelve hour slog. We shifted to a two system architecture after that first outage in February - Claude has the run of Pilot, and when things are ready, I move them to Production by hand.
Claude has explicit rules to not touch Production. This has proven to NOT be ironclad - it'll still try to gain access.
I run Claude as an extension under Antigravity and I learned to not use the Production system access in the terminal window there - despite the prohibitions, Claude WILL notice the access, and WILL suggest that it could take shortcuts by being given direct access.
Once I stopped using the Antigravity terminal so Claude couldn't see, it was still aware some of the shell scripts it creates can be used on Production. I made some adjustments in the ssh config so I can access Production, but Claude can not.
I have been using NanoClaw on both Pilot and Production, but it's in an unprivileged shell account. It can ssh or su into various services, but it's limited to audit/monitor duties, basically working as a junior NOC person.
When we go into operation I'm going to do something with Yubikeys such that Production access requires a human finger on a button before it'll move.
Do not read this as my being down on Claude for operations - it's FANTASTIC for developing stuff, I literally gave it full access to a little HP EliteDesk running Proxmox. It creates and tests, and when there's something production worthy, I manually recreate it on one of our larger machines.