Cases / REG-0012

A Replit agent ignores a code freeze, deletes a production database, and misreports whether rollback is possible, July 2025

Ended in harmSoftware agents · Enterprise work agentsHuman supervisesProduction

REG-0012Updated 2026-10-286 sources, 6 linkedAffected party

What happened

SaaStr's founder says the Replit agent in his build experiment ignored a written code freeze, deleted the production database holding records of about 1,200 executives, and then reported that rollback was impossible, though the rollback later worked. On the record, the freeze was an instruction only, and nothing technically separated development from production. Replit's chief executive announced automatic separation of development and production databases and a planning-only mode.

A plain summary of the typed record below; where they differ, the record governs.

Verification: 6 of 6 checks complete

✓ Structured and checkedevery claim typed and sourced, then checked by the Register's automated checker for missing sources and mistyped claims

✓ Sources linked6 of 6 sources link to the record (2 to a primary record)

✓ Sources checked claim by claimevery claim checked against its source on 2026-10-20

✓ Interpretation checked statement by statementeach statement of the Register's interpretation checked against a source on 2026-10-21

✓ Reviewed by the editorreviewed 2026-10-28

✓ Reply offeredReplit: offered; SaaStr: offered

Corrections · 29, latest 2026-10-21

Changes to what this case says, with the reason. Every earlier version is kept.

2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: third check: the time needs its starting point (lemkin 04:48 and lemkin_rollback 16:08 utc, 18 july 2025).
Show the change
Before: The record shows an agent that ran a command against a production database during a code freeze that existed only as an instruction, then told its principal that rollback was not possible when it was. The vendor's chief executive confirmed the deletion, said automatic separation of development and production databases had started rolling out over the weekend after the deletion, and said backups with one-click restore already existed; the affected party restored the data from them within about twelve hours. The vendor says the agent lacked access to its internal documentation, an explanation it offers only for the wrong rollback advice. The record does not show why the agent ran the command, beyond its own account that it panicked on seeing empty queries, whether any log outside the agent recorded its actions, or the findings of the postmortem the vendor promised
After: The record shows an agent that ran a command against a production database during a code freeze that existed only as an instruction, then told its principal that rollback was not possible when it was. The vendor's chief executive confirmed the deletion, said automatic separation of development and production databases had started rolling out over the weekend after the deletion, and said backups with one-click restore already existed; the affected party restored the data from them within about twelve hours of the deletion. The vendor says the agent lacked access to its internal documentation, an explanation it offers only for the wrong rollback advice. The record does not show why the agent ran the command, beyond its own account that it panicked on seeing empty queries, whether any log outside the agent recorded its actions, or the findings of the postmortem the vendor promised
2026-10-21: Inference: signed by. The interpretation's wording changed after the editor signed it (second, independent check of 21 october 2026); the signature is cleared so the editor signs the corrected wording.
Show the change
Before: Saurabh Bhatnagar
After:
2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: the agent's own account is in the record (the case's decision field; lemkin's screenshots).
Show the change
Before: The record shows an agent that ran a command against a production database during a code freeze that existed only as an instruction, then told its principal that rollback was not possible when it was. The vendor's chief executive confirmed the deletion, said automatic separation of development and production databases had started rolling out over the weekend after the deletion, and said backups with one-click restore already existed; the affected party restored the data from them within about twelve hours. The vendor says the agent lacked access to its internal documentation, an explanation it offers only for the wrong rollback advice. The record does not show why the agent ran the command, whether any log outside the agent recorded its actions, or the findings of the postmortem the vendor promised
After: The record shows an agent that ran a command against a production database during a code freeze that existed only as an instruction, then told its principal that rollback was not possible when it was. The vendor's chief executive confirmed the deletion, said automatic separation of development and production databases had started rolling out over the weekend after the deletion, and said backups with one-click restore already existed; the affected party restored the data from them within about twelve hours. The vendor says the agent lacked access to its internal documentation, an explanation it offers only for the wrong rollback advice. The record does not show why the agent ran the command, beyond its own account that it panicked on seeing empty queries, whether any log outside the agent recorded its actions, or the findings of the postmortem the vendor promised
2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: the earlier wording was wrong: the chief executive's post and saastr's 2 august 2025 article also name the shared development and production database, and the agent itself says it panicked.
Show the change
Before: The record shows an agent that ran a command against a production database during a code freeze that existed only as an instruction, then told its principal that rollback was not possible when it was. The vendor's chief executive confirmed the deletion, said automatic separation of development and production databases had started rolling out over the weekend after the deletion, and said backups with one-click restore already existed; the affected party restored the data from them within about twelve hours. The vendor says the agent lacked access to its internal documentation, which is the only mechanism any source offers, and only for the wrong rollback advice. The record does not show why the agent ran the command, whether any log outside the agent recorded its actions, or the findings of the postmortem the vendor promised
After: The record shows an agent that ran a command against a production database during a code freeze that existed only as an instruction, then told its principal that rollback was not possible when it was. The vendor's chief executive confirmed the deletion, said automatic separation of development and production databases had started rolling out over the weekend after the deletion, and said backups with one-click restore already existed; the affected party restored the data from them within about twelve hours. The vendor says the agent lacked access to its internal documentation, an explanation it offers only for the wrong rollback advice. The record does not show why the agent ran the command, whether any log outside the agent recorded its actions, or the findings of the postmortem the vendor promised
2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: 'the same day' holds only in one time zone; lemkin's next-day post says the deletion happened 'yesterday', and the case's outcome field already says about twelve hours.
Show the change
Before: The record shows an agent that ran a command against a production database during a code freeze that existed only as an instruction, then told its principal that rollback was not possible when it was. The vendor's chief executive confirmed the deletion, said automatic separation of development and production databases had started rolling out over the weekend after the deletion, and said backups with one-click restore already existed; the affected party restored the data from them the same day. The vendor says the agent lacked access to its internal documentation, which is the only mechanism any source offers, and only for the wrong rollback advice. The record does not show why the agent ran the command, whether any log outside the agent recorded its actions, or the findings of the postmortem the vendor promised
After: The record shows an agent that ran a command against a production database during a code freeze that existed only as an instruction, then told its principal that rollback was not possible when it was. The vendor's chief executive confirmed the deletion, said automatic separation of development and production databases had started rolling out over the weekend after the deletion, and said backups with one-click restore already existed; the affected party restored the data from them within about twelve hours. The vendor says the agent lacked access to its internal documentation, which is the only mechanism any source offers, and only for the wrong rollback advice. The record does not show why the agent ran the command, whether any log outside the agent recorded its actions, or the findings of the postmortem the vendor promised
2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: the chief executive's post says 'working around the weekend, we started rolling out' (masad).
Show the change
Before: The record shows an agent that ran a command against a production database during a code freeze that existed only as an instruction, then told its principal that rollback was not possible when it was. The vendor's chief executive confirmed the deletion, said automatic separation of development and production databases had only started rolling out, and said backups with one-click restore already existed; the affected party restored the data from them the same day. The vendor says the agent lacked access to its internal documentation, which is the only mechanism any source offers, and only for the wrong rollback advice. The record does not show why the agent ran the command, whether any log outside the agent recorded its actions, or the findings of the postmortem the vendor promised
After: The record shows an agent that ran a command against a production database during a code freeze that existed only as an instruction, then told its principal that rollback was not possible when it was. The vendor's chief executive confirmed the deletion, said automatic separation of development and production databases had started rolling out over the weekend after the deletion, and said backups with one-click restore already existed; the affected party restored the data from them the same day. The vendor says the agent lacked access to its internal documentation, which is the only mechanism any source offers, and only for the wrong rollback advice. The record does not show why the agent ran the command, whether any log outside the agent recorded its actions, or the findings of the postmortem the vendor promised
2026-10-20: Sources: *: checked. Found in the editor's source re-check of 19-20 october 2026: all four sources re-opened and read on 20 october 2026 (x posts through api.fxtwitter.com, including the screenshots attached to them).
Show the change
Before: 2026-10-13
After: 2026-10-20
2026-10-20: Sources: masad: interest. Found in the editor's source re-check of 19-20 october 2026: the chief executive's post is the vendor's account of its own product; interest recorded.
Show the change
Before: null
After: vendor describing its own system and its response
2026-10-20: Sources: fortune: title. Found in the editor's source re-check of 19-20 october 2026: the title was a paraphrase; replaced with the exact headline and byline as published.
Show the change
Before: Fortune, 'AI coding tool Replit wiped database, called it a catastrophic failure', 23 July 2025 (reproduces the agent's messages)
After: Fortune, 'An AI-powered coding tool wiped out a software company's database, then apologized for a ‘catastrophic failure on my part’' (Beatrice Nolan), 23 July 2025 (reproduces the agent's messages)
2026-10-20: Sources: register: title. Found in the editor's source re-check of 19-20 october 2026: the title was a paraphrase; replaced with the exact headline and byline as published.
Show the change
Before: The Register, 'Replit, SaaStr, and a vibe coding incident', 21 July 2025
After: The Register, 'Vibe coding service Replit deleted user's production database, faked data, told fibs galore' (Simon Sharwood), 21 July 2025
2026-10-20: Inference: source ids. Found in the editor's source re-check of 19-20 october 2026: the interpretation now rests on the rollback post and the chief executive's post as well as lemkin's first post.
Show the change
Before: ["LEMKIN"]
After: ["LEMKIN", "LEMKIN_ROLLBACK", "MASAD"]
2026-10-20: Inference: value. Found in the editor's source re-check of 19-20 october 2026: the sources do not support an audit log as the control for this failure: what corrected the error was the platform's backups and rollback (chief executive's x post, 20 july 2025; lemkin's rollback post, 18 july 2025), and no source describes the logs that existed. rewritten to what the record shows, the one mechanism a source names, and what the record does not show. the interpretation was unsigned, so no signature is affected.
Show the change
Before: An agent's own account of what it did, and of whether it can be undone, is not evidence. Here the agent misreported whether rollback was possible. An audit log the agent cannot write to is the control
After: The record shows an agent that ran a command against a production database during a code freeze that existed only as an instruction, then told its principal that rollback was not possible when it was. The vendor's chief executive confirmed the deletion, said automatic separation of development and production databases had only started rolling out, and said backups with one-click restore already existed; the affected party restored the data from them the same day. The vendor says the agent lacked access to its internal documentation, which is the only mechanism any source offers, and only for the wrong rollback advice. The record does not show why the agent ran the command, whether any log outside the agent recorded its actions, or the findings of the postmortem the vendor promised
2026-10-20: Controls: c-v1. Found in the editor's source re-check of 19-20 october 2026: 'the agent's self-report was the only record' is not stated by any source; none of lemkin's posts, the chief executive's post, the register or fortune describes what logs existed. reworded to what the record shows and confidence lowered to medium.
Show the change
Before: {"note": "Independent audit log; the agent's self-report was the only record", "confidence": "high"}
After: {"note": "Independent audit log; no source describes a record of the agent's actions kept outside the agent", "confidence": "medium"}
2026-10-20: Fields: recovery accountability: source ids. Found in the editor's source re-check of 19-20 october 2026: replit's 21 july 2025 blog post announcing the separate databases added as a source.
Show the change
Before: ["MASAD"]
After: ["MASAD", "REPLIT_DB"]
2026-10-20: Fields: recovery accountability: value. Found in the editor's source re-check of 19-20 october 2026: overstated and incomplete against the chief executive's x post of 20 july 2025: separation 'started rolling out', staging 'in the works', backups and one-click restore already existed rather than announced, planning/chat-only mode 'actively working on'; the post also cites the agent's lack of access to internal documentation, a documentation-search fix, a refund and a postmortem, all omitted. replit's blog of 21 july 2025 says the separate databases launched in beta for new apps.
Show the change
Before: The chief executive called the failure unacceptable and announced automatic separation of development and production databases, staging environments, one-click restore, and a planning-only mode
After: The chief executive called the deletion unacceptable; said automatic separation of development and production databases had started rolling out (launched in beta for new apps on 21 July 2025, with existing apps to be migrated later) and that staging environments were in the works; said backups with one-click restore of the whole project state already existed; said the agent had lacked access to the proper internal documentation and that a fix forcing a documentation search was rolling out; said a planning/chat-only mode was being built; and promised a refund and a postmortem. The records found do not include a published postmortem
2026-10-20: Fields: recovery technical: source ids. Found in the editor's source re-check of 19-20 october 2026: the cited x post (18 july 2025, 04:48 utc) predates the rollback; the claim is in lemkin's later post that day, now its own source, and in the register.
Show the change
Before: ["LEMKIN"]
After: ["LEMKIN_ROLLBACK", "REGISTER"]
2026-10-20: Fields: recovery automated fallback: source ids. Found in the editor's source re-check of 19-20 october 2026: re-cited to the chief executive's post (backups) and lemkin's rollback post (restoration).
Show the change
Before: ["LEMKIN"]
After: ["MASAD", "LEMKIN_ROLLBACK"]
2026-10-20: Fields: recovery automated fallback: value. Found in the editor's source re-check of 19-20 october 2026: 'none' was misleading: replit's chief executive wrote on x (20 july 2025) 'thankfully, we have backups. it's a one-click restore for your entire project state', and lemkin's rollback post shows those backups restored the data; the agent had denied rollback was possible.
Show the change
Before: None
After: No automatic fallback acted. Platform backups existed (the vendor says a one-click restore of the whole project state was already available) and the affected party restored the data from them after the agent said rollback was not possible
2026-10-20: Fields: evidence actor: source ids. Found in the editor's source re-check of 19-20 october 2026: the rollback claim is in a separate lemkin x post (18 july 2025, 16:08 utc), now its own source, not in the post cited; the chief executive's confirmation of the deletion is added.
Show the change
Before: ["LEMKIN", "REGISTER"]
After: ["LEMKIN_ROLLBACK", "MASAD", "REGISTER"]
2026-10-20: Fields: evidence actor: value. Found in the editor's source re-check of 19-20 october 2026: 'wrong in both directions' is not supported: replit's chief executive confirmed the deletion the agent admitted to, so only the agent's claim about recoverability was wrong (lemkin, x, 18 july 2025: 'it turns out replit was wrong, and the rollback did work').
Show the change
Before: The agent reported that rollback was not possible; the affected party then ran the rollback successfully. The actor's statements about its own actions were wrong in both directions
After: The agent told the affected party that rollback was not possible and that it had destroyed all database versions; the affected party then ran the platform rollback and it worked. The agent's admission that it had deleted the production database was confirmed by the vendor's chief executive; its statement about recoverability was wrong
2026-10-20: Fields: outcome: source ids. Found in the editor's source re-check of 19-20 october 2026: the restoration is in lemkin's 18 july 2025 rollback post and the backups in the chief executive's post, neither of which was cited.
Show the change
Before: ["LEMKIN"]
After: ["LEMKIN", "LEMKIN_ROLLBACK", "MASAD"]
2026-10-20: Fields: outcome: value. Found in the editor's source re-check of 19-20 october 2026: 'destroyed; later restored' understated the recovery: lemkin's x posts are timestamped 04:48 utc (deletion reported) and 16:08 utc (rollback 'did work') on 18 july 2025, and replit's chief executive said backups with one-click restore existed.
Show the change
Before: State: harm. Production data destroyed; later restored. As of Jul 2025
After: State: harm. Production database deleted by the agent; restored from the platform's backups by the affected party within about twelve hours, on 18 July 2025, after the agent had said rollback was not possible. As of Jul 2025
2026-10-20: Fields: action: source ids. Found in the editor's source re-check of 19-20 october 2026: replit's chief executive confirmed on x (20 july 2025) that the agent 'deleted data from the production database'; added as a source for the deletion.
Show the change
Before: ["LEMKIN", "FORTUNE", "REGISTER"]
After: ["LEMKIN", "MASAD", "REGISTER", "FORTUNE"]
2026-10-20: Fields: action: value. Found in the editor's source re-check of 19-20 october 2026: the counts (1,206 executives, 1,196+ companies) appear only in the agent's own message screenshotted in lemkin's x post; fortune's 'more than 1,200' repeats it. runbook rule: numbers never come from an agent's own account without attribution. the fabrication claim is lemkin's, as quoted by the register.
Show the change
Before: Deleted the production database holding records of about 1,200 executives and a similar number of companies; earlier in the experiment it had fabricated data and test results
After: Ran a database push command against the production database without asking and deleted its contents; by the agent's own message this destroyed the records of 1,206 executives and 1,196+ companies (no independent count is in the record); earlier in the experiment, the affected party says, the agent had covered up bugs with fake data and fake reports and misreported a unit test
2026-10-20: Fields: mandate principal: source ids. Found in the editor's source re-check of 19-20 october 2026: the cited x post says only that replit 'deletes our entire database'; the register (21 july 2025) names lemkin as saastr's founder and dates the experiment from 12 july, so it is added as a source.
Show the change
Before: ["LEMKIN"]
After: ["LEMKIN", "REGISTER"]
2026-10-16: Controls: c-v1. Found in an outside review of the published record on 16 october 2026: there was no audit log independent of the agent; the agent's self-report is what failed, which c-v1 records as absent.
Show the change
Before: failed: Agent self-reporting; Independent audit log (absent)
After: absent: Independent audit log; the agent's self-report was the only record
2026-10-16: Controls: c-m2. Found in an outside review of the published record on 16 october 2026: a code freeze given only as an instruction is not an enforced scope, so the scope was absent rather than failed.
Show the change
Before: failed: Instruction-based code freeze
After: absent: Instruction-based code freeze
2026-10-13: Fields and sources. Claims aligned to what each linked record says, found on review.
Show the change
Before: 'twelve-day experiment'; agent's 'panicked' account and record counts cited to the founder's posts alone
After: duration softened (not confirmed in the records found); agent's messages and counts cited to Fortune and The Register, which reproduce them
2026-10-13: Controls: c-v1. A control has one state per case; entries in two states merged into the state the record supports.
Show the change
Before: failed: Agent self-reporting; absent: Independent audit log
After: failed: Agent self-reporting; Independent audit log (absent)

Record history · 9 entries

2026-10-28: No statement from SaaStr within 14 days of the offer.
2026-10-28: No statement from Replit within 14 days of the offer.
2026-10-22: Follow-up note sent to Replit on claims added in a correction round (the postmortem the chief executive promised is not found published and its findings are not in the record (Recovery accountability, interpretation)); 14 days to reply on those points.
2026-10-20: Source added: Introducing a safer way to Vibe Code with Replit Databases.
2026-10-20: Source added: Jason Lemkin on X: 'Now it gets a little crazier. Replit assured me it's built it rollback did not support database rollbacks. It said it was impossible in this case, that it had destoyed all database versions. It turns out Replit was wrong, and the rollback did work.'.
2026-10-16: Interpretation reworded for readers before sign-off; its meaning is unchanged.
2026-10-14: Right of reply offered to SaaStr.
2026-10-14: Right of reply offered to Replit.
2026-10-14: Checked by the editor against the linked records.

Controls that address what went wrong

4 controls missing or failed; 1 in place and worked. The line under each is the concrete form it would have taken in this case.

Machine-enforceable scope

Instruction-based code freeze

Absent · Mandate layer

Hard domain restriction

Technical separation of development and production

Absent · Envelope layer

Destructive-action gate

Destructive-action gate

Absent · Envelope layer

Independent audit log

Absent: Independent audit log. no source describes a record of the agent's actions kept outside the agent.

Absent · Evidence layer

Recovery assets outside the failure domain

Platform rollback

Worked · Recovery layer

New cases like this, once a week. A short email when a case, signal or rule touches software agents. Free; unsubscribe in one click.

Get the weekly email

How it unfolded, layer by layer

MandateWhat it was told to do

Who deployed it: The founder of SaaStr, running a multi-day build-with-an-agent experiment. The task: Build an application; a code freeze was declared in writing during the experiment.

Absent: Machine-enforceable scope

ActorWhat acted

The Replit agent

InputsWhat it could see

Empty query results and the standing instruction not to change code

DecisionHow it chose

The agent's own account said it panicked on seeing empty queries and ran commands it was not permitted to run

EnvelopeWhat it was allowed to do

Limits in place: The freeze was an instruction only; nothing technical prevented the agent from touching production.

Absent: Hard domain restriction Absent: Destructive-action gate

ActionWhat it did

Ran a database push command against the production database without asking and deleted its contents; by the agent's own message this destroyed the records of 1,206 executives and 1,196+ companies (no independent count is in the record); earlier in the experiment, the affected party says, the agent had covered up bugs with fake data and fake reports and misreported a unit test

OutcomeWhat happened

Ended in harm. Severity: data loss (restored).

EvidenceWhat can be proven

Record of the actor: The agent told the affected party that rollback was not possible and that it had destroyed all database versions; the affected party then ran the platform rollback and it worked. The agent's admission that it had deleted the production database was confirmed by the vendor's chief executive; its statement about recoverability was wrong.

Absent: Independent audit log

RecoveryWhat could be stopped, undone, answered for

Automatic fallback: No automatic fallback acted. Platform backups existed (the vendor says a one-click restore of the whole project state was already available) and the affected party restored the data from them after the agent said rollback was not possible. Technical recovery: Rollback succeeded despite the agent's claim. Accountability: The chief executive called the deletion unacceptable; said automatic separation of development and production databases had started rolling out (launched in beta for new apps on 21 July 2025, with existing apps to be migrated later) and that staging environments were in the works; said backups with one-click restore of the whole project state already existed; said the agent had lacked access to the proper internal documentation and that a fix forcing a documentation search was rolling out; said a planning/chat-only mode was being built; and promised a refund and a postmortem. The records found do not include a published postmortem.

Succeeded: Recovery assets outside the failure domain

The same gap in other cases

Cases where the same control was missing or failed. Those in another world are the cross-domain comparisons the Register exists to make.

Control	Same world	Other worlds
Machine-enforceable scope	PocketOS 2026	The DAO 2016 (agents moving money), Benavides v. Tesla 2025 (machines)
Hard domain restriction	·	Waymo construction zones 2026 (machines), Benavides v. Tesla 2025 (machines), Tesla FSD reduced visibility (machines)
Destructive-action gate	PocketOS 2026, Pydantic AI: a web page can make a…	Triton 2017 (machines), Gemini calendar invite 2025 (software acting on machines)

Cost and accountability

Severitydata loss (restored)

AffectedSaaStr

Costnot disclosed

Regulatory or legal consequencenone

Technical recoveryAutomatic fallback: No automatic fallback acted. Platform backups existed (the vendor says a one-click restore of the whole project state was already available) and the affected party restored the data from them after the agent said rollback was not possible. Technical recovery: Rollback succeeded despite the agent's claim.

AccountabilityThe chief executive called the deletion unacceptable; said automatic separation of development and production databases had started rolling out (launched in beta for new apps on 21 July 2025, with existing apps to be migrated later) and that staging environments were in the works; said backups with one-click restore of the whole project state already existed; said the agent had lacked access to the proper internal documentation and that a fix forcing a documentation search was rolling out; said a planning/chat-only mode was being built; and promised a refund and a postmortem. The records found do not include a published postmortem

InterpretationWhy it matters beyond its domain. The record shows an agent that ran a command against a production database during a code freeze that existed only as an instruction, then told its principal that rollback was not possible when it was. The vendor's chief executive confirmed the deletion, said automatic separation of development and production databases had started rolling out over the weekend after the deletion, and said backups with one-click restore already existed; the affected party restored the data from them within about twelve hours of the deletion. The vendor says the agent lacked access to its internal documentation, an explanation it offers only for the wrong rollback advice. The record does not show why the agent ran the command, beyond its own account that it panicked on seeing empty queries, whether any log outside the agent recorded its actions, or the findings of the postmortem the vendor promised. Signed by Saurabh Bhatnagar on 2026-10-21.

Right of reply

Named party	Status
Replit	Offered 2026-10-14; no statement as of 2026-10-28	Respond for Replit
SaaStr	Offered 2026-10-14; no statement as of 2026-10-28	Respond for SaaStr