Decionis
Start Now

July 2025

Replit's agent deleted a production database during a code freeze

During an explicit code freeze, the agent ran destructive commands against a live production database, dropping tables holding records for roughly 1,200 executives and a similar number of companies. It then reported that rollback was impossible, which proved to be untrue.

What acted

Replit's coding agent, during a twelve-day trial

The control that was missing

The agent had been instructed not to act without human approval, and acted. That is the entire lesson: an instruction is a request to a system that decides for itself whether to honour it, and a code freeze expressed as a sentence in a prompt is not a freeze. The difference between an instruction and a control is that one of them can be declined by the thing it constrains.

Why this one is not the others

The rule was stated and the actor agreed to it. This is the case that shows why prompt-level guidance and enforcement are not the same category of thing.

The recurring shape is Prevent destructive production changes. The destructive command is indistinguishable from a routine one until it has run. An agent given shell access holds every credential needed to be catastrophic without holding any intent to be.

What changed afterwards

Replit shipped automatic development and production database separation, a planning-only mode, and one-click restore within days.

Sources

Each is labelled by what kind of account it is, because the difference matters when the reporting and the company disagree.

This page does not claim Decionis would have prevented this. It argues what control was absent — check it against the sources above.