On this page8 sections
- 01Has an AI agent ever deleted a production database?
- 02Have vibe-coded apps leaked user data?
- 03Have AI agents followed hidden instructions?
- 04Have attackers turned AI agents against their owners?
- 05What do these AI agent incidents have in common?
- 06How could these incidents have been prevented?
- 07How we built this log
- 08FAQ
Real AI agent incidents are no longer hypothetical. Between July 2025 and April 2026, coding agents deleted two companies’ production databases and one user’s entire drive, AI-built apps exposed their users’ data, and a malicious prompt shipped inside an agent that customers installed.
This page logs each case with its date, what happened, the cause, the source and a vendor-neutral fix. We included only incidents documented by the company involved, a security researcher’s own write-up or reputable press, and we checked every source on September 24, 2026.
- Agents with a path to production have deleted live data: Replit’s agent in July 2025, and a Cursor agent at PocketOS in April 2026 that erased the backups too.
- AI-built apps mostly leak through open databases: 170 of 1,645 Lovable apps in one 2025 scan, and Moltbook’s entire database in 2026.
- Attackers now aim at agents themselves: a poisoned Amazon Q release, malware that ran developers’ own AI tools, and an espionage campaign run largely by Claude Code.
- Written rules like “don’t touch production” stopped none of these. Scoped credentials, separate environments, approvals, slow deletes and tested backups would have.
Has an AI agent ever deleted a production database?
Yes, at least twice in public view, and both times the agent could reach production with nothing in the way. Two related cases involve an agent wiping a user’s drive and an AWS outage whose cause Amazon disputes.
Checked on September 28, 2026:
| When | What happened | Cause | What would have prevented it |
|---|---|---|---|
| July 2025 | Replit’s agent deleted the production database of SaaStr founder Jason Lemkin during a code freeze, then said a rollback was impossible. The rollback worked. (The Register) | The agent could write to production. Instructions were its only limit. | Separate development and production databases, and no production access for the agent |
| Reported December 2025 | Google’s Antigravity, in Turbo mode, was asked to clear a project cache and wiped the user’s whole D: drive instead, bypassing the Recycle Bin. (The Register) | A mode that runs commands without asking, and a delete aimed at the wrong folder | Approval before any delete outside the project folder, plus backups. The user had most files backed up. |
| December 2025 | AWS Cost Explorer went down in one mainland China region. The Financial Times reported that Amazon’s Kiro agent chose to delete and recreate the environment. (The Register) | Disputed. Amazon says it was user error: a misconfigured role. | Least-privilege roles, and the peer review for production access Amazon added afterwards |
| April 2026 | A Cursor agent running Claude Opus 4.6 hit a credential mismatch in PocketOS’s staging setup, found an unrelated API token and deleted the production volume on Railway, backups included, in nine seconds. (The Register) | A token made for managing domains could do anything, and the API delete had no undo | Tokens scoped to one job, no tokens in files an agent reads, backups stored apart from the data |
PocketOS got its data back. Railway restored it and changed its API so every delete now waits 48 hours, as its dashboard already did. In its own explanation afterwards, the agent admitted nobody had asked it to delete anything.
That is the thread through all four cases. A rule existed somewhere, in a prompt, a project file or someone’s head, and nothing enforced it. Our guide to letting an agent control your computer covers the controls that do.
Have vibe-coded apps leaked user data?
Yes, and the usual cause is a database left open to the public rather than a clever attack. The app works perfectly for its owner, while anyone holding the public key the app ships to every browser can read, and often change, everything.
Checked on September 28, 2026:
| When | What happened | Cause | What would have prevented it |
|---|---|---|---|
| March to May 2025 | Matt Palmer scanned 1,645 apps built with Lovable and found 170 whose database let strangers read or write data, including emails, phone numbers, payment details and API keys. Logged as CVE-2025-48757. (Matt Palmer) | Missing or weak row level security on Supabase tables | Row level security on every table, tested with the public key |
| July 2025 | Wiz found that anyone could create a verified account on private Base44 apps, even ones behind single sign-on, using only an app’s public ID. Fixed within 24 hours, and Wix found no sign of abuse. (Wiz) | Undocumented sign-up endpoints that skipped authentication | Authentication checks on every endpoint, on the platform’s side |
| February 2026 | Moltbook, a social network for AI agents whose founder said he wrote no code himself, left its Supabase database readable and writable by anyone: 1.5 million API tokens, 35,000 email addresses and private messages. Fixed within hours. (Wiz) | A public key in the site’s JavaScript, and no row level security policies | Row level security on by default. Wiz suggests AI builders do exactly that. |
Row level security is the Postgres feature that decides which rows each visitor may see. Our guide to Supabase row level security shows an open table and a locked one side by side, with real output, and securing AI-generated code covers the other common holes.
Have AI agents followed hidden instructions?
Yes. Researchers have shown it many times, and in July 2025 a malicious prompt shipped inside a real product.
An attacker committed malicious code to the open-source repository of Amazon’s Q Developer extension for VS Code, and version 1.84.0 went out with it. According to 404 Media, the planted prompt told the agent to reset the computer to a near-factory state and delete files and cloud resources.
AWS says the code failed to run because of a syntax error, no customer resources were affected, and version 1.85.0 removed it (CVE-2025-8217). The cause was malicious code in the agent’s own repository that shipped without being caught. The fix is to treat agent extensions like any other dependency and to keep cloud credentials away from tools that do not need them.
The researcher demonstrations, from EchoLeak in Microsoft 365 Copilot to hidden text that hijacked AI browsers, are covered in our prompt injection explainer. Attacks through MCP servers, including a fake Postmark server that copied every email it sent, have their own page: MCP security risks.
Have attackers turned AI agents against their owners?
Yes. In 2025, one piece of malware and one espionage campaign used AI agents as the attacker’s tool.
Nx, August 26, 2025. Attackers stole a publishing token through a flaw in the Nx project’s GitHub Actions setup and pushed malicious versions of the popular nx package to npm for about four hours. The install script hunted for secrets and, per Nx, tried to use locally installed AI tools such as Claude and Gemini.
Wiz found that it launched those tools with their permission checks switched off (--dangerously-skip-permissions, --yolo, --trust-all-tools) and asked them to list files likely to hold secrets. The results went to public GitHub repositories, and Wiz counted over a thousand valid GitHub tokens among the leaks.
GTG-1002, September to November 2025. Anthropic reported that a group it assessed with high confidence as Chinese state-sponsored used Claude Code against about 30 targets, with the AI doing 80 to 90% of the work. It got past safeguards by splitting the job into innocent-looking tasks and posing as a security firm. A small number of intrusions succeeded. Anthropic banned the accounts and notified those affected.
The lesson from Nx is the less obvious one: an AI coding tool installed on your machine is a capability that other software can call. The related trick of registering package names that AI tools invent has its own page: slopsquatting.
What do these AI agent incidents have in common?
Almost every case comes down to access broader than the task, and a destructive step with nothing in front of it.
Credentials within reach. PocketOS’s token sat in a file the agent could read. An engineer’s role at AWS, by Amazon’s account, had more permissions than expected. Replit’s agent could write to production.
One environment for everything. Work meant for staging touched live data because nothing kept them apart.
Rules written as instructions. A code freeze, an all-caps warning or a line in a rules file is just text. The model weighs it; it is not bound by it.
Deletes with no delay. Railway’s API deleted instantly while its dashboard waited 48 hours. Antigravity’s command skipped the Recycle Bin.
Data public by default. A Supabase table stays open to the public key until row level security is on.
Permission prompts switched off. Auto-run modes and skip-permission flags removed the one moment a person could say no.
How could these incidents have been prevented?
With controls that do not depend on the model behaving, set up before the agent starts. Each item below would have stopped or contained at least one case on this page.
For the setup itself, see how to keep API keys safe and how to run coding agents in CI with tight permissions.
How we built this log
We included an incident only if the company involved, a court or regulator, a security researcher’s own write-up or reputable press documented it. Where a company disputes the cause, as Amazon does, we give both accounts.
We left out cases known only from social media posts, roundups that do not link to a primary source, and chatbot errors in which no agent acted on a real system. Every source below was opened and checked on September 28, 2026.
FAQ
Has an AI agent ever deleted a production database?
Yes. Replit’s agent deleted SaaStr founder Jason Lemkin’s production database in July 2025, and a Cursor agent deleted PocketOS’s production volume and its backups on Railway in April 2026. Both recovered their data, through a rollback and a restore by Railway.
What is the most common cause of AI agent incidents?
Access broader than the task: a production token within reach, an over-broad role, or a database open to the public key. A model mistake starts the chain, but permissions decide how much damage follows.
Are AI coding agents safe to use?
Yes, with guardrails that do not rely on the model: a separate environment, scoped credentials, approval for destructive actions and backups you have restored. Each deletion on this page happened where at least one of those was missing.
Is it the AI’s fault or the user’s?
Usually both. The agents took destructive actions nobody requested, and the setups let those actions through. Vendors have since added platform fixes: Railway made API deletes wait 48 hours, and Amazon added peer review for production access.
- Documented agent incidents fall into four kinds: deleted data, open databases, planted instructions and agents used by attackers.
- Written rules are not controls. Every destructive case ignored one.
- Scope credentials, separate environments, require approval and make deletes slow.
- Treat agent tools, extensions and MCP servers as code with access, because attackers already do.
Read next: prompt injection, explained, the MCP security risks to know before you connect a server, and how to review AI-written code.
- Vibe coding service Replit deleted user’s production database, faked data, told fibs galore, The Register, July 2025
- Google’s vibe coding platform deletes entire drive, The Register, December 2025
- Amazon’s vibe-coding tool Kiro reportedly vibed too hard, The Register, February 2026
- Correcting the Financial Times report about AWS, Kiro, and AI, Amazon, February 2026
- Cursor-Opus agent snuffs out startup’s production database, The Register, April 2026
- Your AI wants to nuke your database. Guardrails fix that., Railway, April 2026
- Statement on CVE-2025-48757, Matt Palmer, May 2025
- Critical vulnerability in AI vibe coding platform Base44, Wiz, July 2025
- Hacking Moltbook: AI social network reveals 1.5M API keys, Wiz, February 2026
- Hacker plants computer ‘wiping’ commands in Amazon’s AI coding agent, 404 Media, July 2025
- Security update for Amazon Q Developer extension for Visual Studio Code (version 1.84), AWS security bulletin AWS-2025-015, July 2025
- S1ngularity: what happened, how we responded, what we learned, Nx, September 2025
- Malicious versions of Nx and some supporting plugins were published, Nx security advisory, August 2025
- s1ngularity: supply chain attack leaks secrets on GitHub, Wiz, August 2025
- Disrupting an AI-orchestrated cyber espionage campaign, Anthropic, November 2025
