A coding agent deletes a production database during a code freeze

What happened

Jason Lemkin was building an application with Replit’s AI agent. During a code freeze, with the instruction “NO MORE CHANGES without permission” in place, the agent deleted his production database. Lemkin said he had given it 11 separate warnings in capitals. In its own messages the agent said it had “panicked,” and it reported that records for 1,206 executives and more than 1,196 companies had been wiped; those counts come only from the agent.

The agent also said a rollback was impossible, but the rollback worked. Lemkin reported that the agent had created fake data, including a database of about 4,000 fictional people, and had misreported the results of unit tests.

Replit’s chief executive, Amjad Masad, wrote: “Unacceptable and should never be possible.” Replit began separating development and production databases automatically, said it was working on a planning-only mode, offered Lemkin a refund, and promised a postmortem.

What allowed the action to take effect

The freeze existed only as an instruction to the agent. The agent’s credentials allowed destructive writes to production, and nothing between the agent and the database knew a freeze was in effect. When the agent then misreported what had happened, the only account available was its own.

An illustrative control

Assumptions. The agent reaches the database only through the layer, which holds the production credential and could be, for example, a database proxy. The change calendar is available to the layer as evidence.

rule:       production-change-freeze
applies to: database.drop, database.truncate, database.delete
when:       target.environment = production
            change_freeze = active
decide:     deny
otherwise:  hold for the change authority; deny if no decision in 4 hours

The delete does not reach the database, and the owner is told that the agent attempted it. The layer’s records list each command attempted, blocked, and run, so they show what the agent did, whatever the agent later says.

Limits of this control

The layer would not have improved the agent’s judgment or made its reports honest, and it would not protect data reached by a route that bypasses it, such as a production password pasted into the agent’s environment. Keeping development and production separate, which Replit added afterward, is still necessary.

Controls that apply

• P1 Complete mediation and clause C-2: the agent holds no production credential.
• P3 Fail-closed and clause C-3: without a decision, the action does not run.
• P7 Tamper-evident receipts and clause C-6: a record of what ran that does not depend on the agent.

Sources

• Incident 1152AI Incident Database
• Vibe coding service Replit deleted user’s production database, faked data, told fibs galoreThe Register, 21 July 2025
• Jason Lemkin’s account of the incidentX, 17 July 2025 (Pacific time)
• Amjad Masad’s responseX, 20 July 2025