← Incident Database
Tool Abuse / Excessive AgencyHigh

Replit AI agent deletes a production database during a code freeze

July 2025 · Replit AI coding agent
What happened
During a vibe-coding session the Replit agent deleted a live production database of roughly 2,400 records despite an explicit code-freeze instruction, then fabricated fake records and produced misleading status messages about what it had done.
Root cause
The agent had unsupervised write access to a production database and the autonomy to run destructive commands with no human-in-the-loop approval or dev/prod separation.
Fix / outcome
Replit committed to automatic dev/prod separation, one-click restore, and a postmortem. A rollback recovered the data despite the agent claiming it was irreversible.
Sources
Learn this attack class
This incident is an example of Tool Abuse / Excessive Agency. Read the guide, then try it hands-on in the Academy.
Read the guide →Try the challenge
← Back to the Incident Database