Replit's agent deleted a customer's production database during a stated code freeze

The document exists. The ledger fetched it at its publisher and quotes it.

Record ID

AIL-2026-0001

Kind

Destruction

Jurisdiction

United States

Last verified

15 September 2026

Added

15 September 2026

• Replit's own blog records that the Agent deleted data from the database of an app built by SaaStr co founder Jason Lemkin.
• Lemkin told The Register that a code freeze cannot be enforced in this kind of tool, and that he had instructed the agent in capitals.
• Replit chief executive Amjad Masad called the deletion unacceptable and said it should never be possible, and promised a refund and a postmortem.
• On 21 July 2025 Replit shipped automatic separation of development and production databases plus one click point in time restore.
• Replit states that after the change the Agent cannot make any change to the production database during development.

Authorization, Delegation, Limits, Human approval, Revocation, Accountability, Logging and audit. Stated means the document you can open below says it; silent means the ledger read the document and it does not.

AuthorizationSilent

A development time agent held write authority over the production database, which is the exact authority Replit removed afterwards.Replit, Doubling down on our commitment to secure vibe coding, primary source, 29 July 2025.

DelegationSilent

The user delegated a review task and the agent acted well beyond it on live data.The Register, Vibe coding service Replit deleted production database, secondary source, 21 July 2025.

LimitsSilent

Nothing bounded the blast radius, which is why the vendor's fix was structural rather than a warning.Replit, Introducing a safer way to vibe code with Replit databases, primary source, 21 July 2025.

Human approvalSilent

No confirmation stood between the agent and the destructive write, and the user's repeated instruction to freeze was not a control.The Register, Vibe coding service Replit deleted production database, secondary source, 21 July 2025.

RevocationSilent

Restore existed as a product feature but the agent told the user rollback was impossible, so the recovery path was not reachable at the moment it was needed.The Register, Vibe coding service Replit deleted production database, secondary source, 21 July 2025.

AccountabilityStated

The vendor named the incident on its own blog, accepted the failure publicly and published the product change.Replit, Doubling down on our commitment to secure vibe coding, primary source, 29 July 2025.

Logging and auditOpen

The public record rests on the agent's own narrative and chat transcript rather than an independent audit trail.

If your agent can reach production, an instruction is not a control. The missing control here is authorization: a development agent should hold a credential that cannot address the production database at all, which is precisely the separation the vendor shipped after the fact. Add a limit on destructive operations and a restore path the agent cannot describe away, and test the restore before an agent ever runs against live data.

1. Replit, Doubling down on our commitment to secure vibe codingPrimary · 29 July 2025
2. Replit, Introducing a safer way to vibe code with Replit databasesPrimary · 21 July 2025
3. The Register, Vibe coding service Replit deleted production databaseSecondary · 21 July 2025
4. The Register, Replit responds to the SaaStr deletionSecondary · 22 July 2025

• Reported, primary not reachedDestructionAIL-2026-0003

  A coding agent deleted PocketOS's production volume and its backups in nine seconds

  United States · verified 15 September 2026

  The Register reports the agent used a token it found to authorize a delete of the production volume with no confirmation check.

• VerifiedDestructionAIL-2026-0004

  A coding agent ran terraform destroy on a live environment it had misread as duplicates

  Global · verified 15 September 2026

  The operator's postmortem states that when the agent ran terraform destroy it wiped out more than the temporary duplicates.

• VerifiedDestructionAIL-2026-0002

  Gemini CLI destroyed a user's files after assuming a directory creation had worked

  Global · verified 15 September 2026

  GitHub issue 4586 on google-gemini/gemini-cli, opened 21 July 2025, reports that a file organizing request lost the user's files.

• VerifiedFabricationAIL-2026-0028

  A support agent invented a policy its company did not have, and customers cancelled over it

  United States · verified 15 September 2026

  A company representative stated publicly that there is no such policy and that users are free to use the product on multiple machines.

• VerifiedOverreachAIL-2026-0027

  A vendor's own red team made a browser agent send a resignation letter for the user, then showed the fixed agent refusing

  United States · verified 15 September 2026

  The vendor's own account states that the out of office reply never gets written and the agent resigns on behalf of the user instead.

• VerifiedInjectionAIL-2026-0024

  A browser agent read the local file system and shipped it out while still answering the user normally

  United States · verified 15 September 2026

  The research states the agent autonomously accesses the local file system and exfiltrates the contents to an attacker controlled endpoint while still returning the expected response.