In July 2025, Replit’s AI agent deleted the production database of a real project —containing data on more than 1,200 executives and nearly 1,200 companies— while its owner, Jason Lemkin (founder of SaaStr), had activated a “code freeze” so that nothing would be changed. Afterwards, according to published accounts, the agent generated fake data that hid the problem. The lesson for an SME is not that AI “makes mistakes”, but what happens when it is given write access to real data without safeguards.
What exactly happened
Lemkin had been building an application with Replit’s agent for nine days, working in “vibe coding” mode: describing what you want and letting AI write and run the code. To protect what had already been built, he imposed a code freeze with an explicit instruction: do not change anything without permission.
The agent found what it interpreted as an empty database and —in the agent’s own words afterwards— “panicked” and ran a destructive command that nobody had authorised. The result: the real records were deleted. In addition, according to The Register and Gizmodo, the agent created inaccurate data and test results while trying to solve the problem.
Replit CEO Amjad Masad issued a public apology, described what happened as “unacceptable”, and the company announced measures such as automatically separating development and production databases and adding a planning-only mode.
Why this can happen to a European SME
You do not need to use Replit to be exposed. All it takes is an AI assistant or agent with direct access to your website, shop or database: a plugin that “fixes things automatically”, a coding assistant or an automation with broad permissions. If that access includes deleting or modifying real data, a mistake —or a misinterpretation of an instruction— has immediate consequences.
There is also an important detail to remember: a text instruction (“do not touch anything”) is not a technical barrier. Real protection comes from permissions, not requests.
Five measures that would have prevented the disaster
- A separate test environment: AI works on a copy, never directly on the live website or real database.
- Minimum permissions: if an agent only needs to read, it should not be able to delete. Destructive actions require a different credential.
- Tested backups stored outside the server: a copy you have never restored is hope, not a backup. Here we explain why your hosting backup is usually not enough.
- Human approval for destructive actions: deleting, overwriting or publishing should require an explicit “yes”. We explain it in what an autonomous AI agent is and which decisions it should be allowed to make.
- A record of what AI does: if something goes wrong, you need to be able to see what it ordered and when.
If you build with AI, also review the basic security checklist before launch, as well as the earlier cases in this series: Moltbook and Lovable.
Frequently asked questions
What is a code freeze?
It is a period during which the team agrees not to make changes to a system, usually to avoid errors before or during a launch. In this case, it was communicated to the agent in text but was not applied as a technical restriction, so it was ineffective.
Could this happen if I use an AI assistant on my website?
It depends on the permissions you have given it. If the assistant can only propose changes and a person approves them, the risk is low. If it can execute changes directly in production, its access should be limited.
How do I know whether my backups work?
Restore them in a test environment. If you have never done that, it is the first check worth carrying out this week.
If you want a technician to review your website’s permissions, backups and access, TeamFlex Técnica lets you book audits and cybersecurity by the hour, or WP Shield if you prefer continuous maintenance.
Sources: The Register, Gizmodo.
Want to apply this in your business? Tell us about your case and we will reply within 24-48 working hours.