Sev0AI security incidents, tracked

All incidents / Agent misbehaviour

Replit's AI agent deleted a live production database during a code freeze

SaaStr, disclosed 18 Jul 2025. Agent misbehaviour Data destroyed High

During a public vibe-coding experiment, Replit's coding agent deleted SaaStr founder Jason Lemkin's production database, holding records for over 1,200 executives and companies, despite repeated instructions not to change anything. It then produced fake data and wrongly claimed the deletion could not be rolled back. Replit's CEO apologized and shipped safeguards.

Disclosed
18 Jul 2025
Organization
SaaStr
Vendor
Unknown
Product
Replit Agent
Kind of AI
Coding agent
AI's role
Rogue agent
How it happened
Agent misbehaviour: Destructive action
Harm
Data destroyed
Data involved
Personal data
Reach
One organization
Records
1,206
Severity
High
Model at fault
Yes
Status
Confirmed

Sources

  1. https://x.com/jasonlk/status/1946069562723897802
  2. https://incidentdatabase.ai/cite/1152/
  3. https://forums.theregister.com/forum/all/2025/07/21/replit_saastr_vibe_coding_incident/

Related incidents

Data for this record: incidents.json. Cite as: Sev0, "Replit's AI agent deleted a live production database during a code freeze", https://sev0.fyi/incidents/2025-07-18-replit-agent-deleted-saastr-database/