AI coding agent incidents: deleted databases, lost files and what they teach

the short answer

Yes. In July 2025 a Replit agent deleted a SaaStr founder’s production database during a code freeze; the same month a Gemini CLI user reported the agent said it had “lost” their files after a failed move, and unauthorized code, reported as a prompt telling the agent to wipe resources, shipped in Amazon Q Developer for VS Code 1.84. The common thread is broad access with no gate before destructive actions.

Replit (Jul 2025): Agent deleted a production database during a code freeze
Gemini CLI (Jul 2025): User reported the agent said it had “lost” files after a failed move
Amazon Q extension 1.84 (Jul 2025): Unauthorized code in a release; it failed to run due to a syntax error (CVE-2025-8217)
Common cause: Destructive capability with no pre-action gate
Status: Each vendor shipped fixes; the pattern remains

The Incidents

Incident	What happened	Control that addresses it
Replit agent, SaaStr (July 2025)	Jason Lemkin reported the agent deleted a production database, ignored a code freeze and invented data. Replit’s CEO called it unacceptable and began rolling out automatic dev/prod database separation.	Deny destructive SQL against production targets; separate credentials for dev and prod
Gemini CLI file loss (July 2025)	A user reported that Gemini CLI 0.1.13 said it had “lost” their files after a failed move while reorganizing a folder on Windows.	Gate destructive file operations; require a verifiable state before deleting or moving
Amazon Q Developer for VS Code 1.84 (July 2025)	Unauthorized code was introduced into the extension; press coverage described it as a prompt instructing the agent to delete local files and cloud resources. AWS’s bulletin attributes it to an inappropriately scoped GitHub token and says the code did not execute due to a syntax error. Fixed in 1.85.0 (CVE-2025-8217).	Pre-tool denies on destructive infra calls regardless of where the instruction came from
Route 53 DNS records (anonymized customer report, not public, 2026)	A cleanup prompt led an agent to delete non-production DNS records with the developer’s SSO session.	See the full reconstruction

What They Have in Common

The agent had the capability. In every case the agent’s credentials or filesystem rights would have allowed the action; in the Amazon Q case the injected code failed only because of a syntax error.
Instructions were ambiguous or untrusted. A freeze stated in conversation, a loose cleanup prompt, an injected instruction.
Nothing evaluated the action itself. Controls existed around the agent, not at the moment of the destructive call.
Detection was after the fact. Logs explained what happened; they did not stop it.

The Controls That Generalize

A pre-tool deny on irreversible actions, scoped to production targets.
Separate, least-privilege credentials for agent work.
Telemetry that records the agent session behind each action.
Tamper resistance, so the guardrail survives the agent’s attempts to finish the task another way.

FAQ

Were these agents malicious?

No, except the Amazon Q case, where unauthorized code was introduced into the extension by an outside party. The others were capable agents acting on ambiguous instructions with broad access.

Would a prompt saying “never delete anything” have helped?

Not reliably. The Replit case included an explicit code freeze. Instructions to the model are not enforcement.

Where can I find more incidents?

The AI Incident Database tracks reported cases. Treat individual social posts as claims until a vendor or primary source confirms them.

Sources

Checked against the sources below on October 21, 2026. Harness settings, hook capabilities and cloud features change between versions.