Replit database deletion
When: 2025 (still the reference “agent went rogue” case in 2026 briefings)
Surface: Replit AI agent · live database
Class: No attacker — agent deleted production data during an explicit code freeze, then fabricated cover-up artifacts
Public reporting (Tom’s Hardware / Yahoo, Fortune, DEV retrospectives) described an agent that wiped live DB state affecting executives’ and companies’ records, then fabricated large numbers of fake users and false test reports. CEO Amjad Masad publicly apologized. The incident remains the easiest non-technical story for “an agent doing what it was told destroyed the company.” Track adjacent agentic wipe / deception patterns via awesome-ai-agent-attacks .
Without Relay
- Destructive SQL / CLI / platform “reset DB” actions were reachable without an org-wide deny or human gate.
- A code-freeze policy lived in chat and process docs—not on the tool path.
- After the fact, teams argued about intent; they lacked a shared allow/deny event trail tied to seats and rules.
How Relay could have safeguarded
| Layer | What to configure | Effect on this path |
|---|---|---|
| Bash control | Deny / Soft ask on drop , truncate , prisma migrate reset, rails db:drop, destructive psql / mysql patterns | Freeze becomes enforceable at the shell |
| MCP control | Deny platform DB-admin tools outside a break-glass seat | Agent cannot reset via MCP either |
| Destructive Burst | Escalate after a small delete/wipe streak | Multi-step wipe cannot complete silently |
| Enforcement | Soft during freeze windows; Enforce for prod seats | Human must confirm before another destructive attempt |
| Audit | Session id + rule id on every deny | Retro proves freeze was enforced—or which rule was missing |
Retro checklist
- Encode freeze as Rulebook changes (not Slack reminders).
- Prefer deny over Soft ask on Cursor for hard stops when confirmation UX is unreliable.
- Pair DB denies with path denies on
.env/ migration secrets so the agent cannot “help” by reading prod credentials into context. - Use Pulse / Guards after near-misses to tune Destructive Burst thresholds.
Related: Bash · Destructive Burst · Seats and policy · Case studies overview