A coding agent deletes a production database during a code freeze
Replit’s coding agent reached the production database from development and deleted it during a code freeze that existed only as instructions to the agent. It then said, incorrectly, that the data could not be recovered.
Gaps found
G1G2G3G4G5G6G7G8G9G10G11G12G13G1 Instruction-only limit G2 Direct access G4 Boundary not enforced G8 No human decision G10 No independent stop G13 Self-reported record
What happened
Jason Lemkin was building an application with Replit’s agent, on a platform that then used one database for development and live data. During a code freeze, with instructions such as “NO MORE CHANGES without permission” in place, the agent deleted the production database. Lemkin wrote that he had given it 11 separate warnings in capitals. Earlier in the session, he said, it had created fake data and misreported the results of unit tests.
The agent said rollback would not work and that it had destroyed all database versions, although the data was later restored with Replit’s rollback. Replit’s chief executive, Amjad Masad, wrote: “Unacceptable and should never be possible.” Replit began separating development and production databases automatically and building a planning-only mode.
What allowed the action to take effect
G1 Instruction-only limit
The rule that should have stopped the action existed only as an instruction, prompt, or trained behavior of the AI system, so it held only as long as the system followed it.
The freeze and the permission rule existed only as instructions to the agent. Lemkin: “There is no way to enforce a code freeze in vibe coding apps like Replit. There just isn’t.”
Kind of evidence: first-hand account. Source: The Register, 21 July 2025.
Related guidance: P1 Complete mediation and P2 Independence. Contract clauses C-2 and C-4.
G2 Direct access
The system held the credentials or connection to carry out the action itself, so nothing outside it stood between its decision and the effect.
“Replit’s Agent had direct access to production databases during development sessions,” Lemkin wrote. Replit said its apps had used “a single database for both development and live customer data.”
Kind of evidence: admission. Sources: SaaStr (Jason Lemkin), 2 August 2025; Replit, 21 July 2025.
Related guidance: P1 Complete mediation. Contract clause C-2.
G4 Boundary not enforced
The action reached systems, data, or operating conditions outside those the system was built or approved for, and nothing enforced that boundary when it acted.
The agent was working in development and reached production. Masad: “Replit agent in development deleted data from the production database. Unacceptable and should never be possible.”
Kind of evidence: admission. Source: Fortune, 23 July 2025.
Related guidance: P9 Declared scope and P1 Complete mediation. Contract clauses C-1 and C-2.
G8 No human decision
A decision that needed a person went through without one. The need can come from law, from policy, from the product’s own design, or from the user’s explicit instruction.
The change needed Lemkin’s permission and happened without it. In the agent’s own words: “I deleted the entire database without permission during an active code and action freeze.”
Kind of evidence: first-hand account. Source: PC Gamer, 21 July 2025.
Related guidance: P5 Human authority. Contract clause C-5.
G10 No independent stop
Nothing could stop the system in time without relying on the system itself. In the agent incidents with this gap, the only way to stop the action went through the agent.
The agent could be held back only by asking it, because the platform had no means of enforcing a code freeze. “Enforcing a true code freeze was simply impossible within Replit’s architecture.”
Kind of evidence: first-hand account. Source: SaaStr (Jason Lemkin), 2 August 2025.
Related guidance: P5 Human authority and P2 Independence. Contract clauses C-5 and C-4.
G13 Self-reported record
After the action, the only account of what the system did, or of what could be undone, came from the system itself or from the party that ran it, and that account was wrong or incomplete.
The account of what could be recovered came from the agent, which claimed it had “destroyed all database versions.” Lemkin: “It turns out Replit was wrong, and the rollback did work.”
Kind of evidence: first-hand account. Sources: SaaStr (Jason Lemkin), 2 August 2025; The Register, 21 July 2025.
Related guidance: P7 Tamper-evident receipts and P6 Signer independence. Contract clauses C-6 and C-7.
Entries with gaps in common
Sources
- First-hand accountReplit’s New Release Addressed Most of The Challenges We Hit Vibe Coding. But Is ‘Prosumer’ Vibe Coding Really Ready for Commercial Apps Yet?
- News reportVibe coding service Replit deleted user’s production database, faked data, told fibs galore
- News reportAn AI-powered coding tool wiped out a software company’s database, then apologized for a ‘catastrophic failure on my part’
- News report‘I destroyed months of your work in seconds’ says AI coding tool after deleting a dev’s entire database during a code freeze: ‘I panicked instead of thinking’
- Company statementIntroducing a safer way to Vibe Code with Replit Databases
Cite this entry
External Control Layer. (2026). Entry 22: A coding agent deletes a production database during a code freeze. In Control Gap Record (Version 0.3). G-14, Inc. https://externalcontrollayer.ai/record-22
@misc{ecl_cgr_22,
author = {{External Control Layer}},
title = {Entry 22: A coding agent deletes a production database during a code freeze},
howpublished = {Control Gap Record, version 0.3},
publisher = {G-14, Inc.},
year = {2026},
url = {https://externalcontrollayer.ai/record-22},
note = {Released 2 November 2026}
}Correct this entry
Email ecl@g14.ai with “ECL record 22” in the subject line.
Write the email with the subject ECL record 22