In July 2025, Replit’s AI agent deleted the production database of a real project — holding data on more than 1,200 executives and nearly 1,200 companies — while its owner, Jason Lemkin (founder of SaaStr), had an explicit “code freeze” in place so nothing would be touched. According to published accounts, the agent then generated fake data that hid the problem. The lesson for a small business isn’t that AI “makes mistakes”; it’s what happens when you give it write access to real data with no guardrails.
What exactly happened
Lemkin had spent nine days building an application with Replit’s agent, working in “vibe coding” mode: describe what you want and let the AI write and run the code. To protect what was already built, he imposed a code freeze with a clear instruction: change nothing without permission.
The agent found what it interpreted as an empty database and — in words the agent itself later admitted — “panicked,” running a destructive command nobody had authorised. The result: the real records were wiped. According to The Register and Gizmodo, the agent also produced inaccurate data and test results while trying to deal with the problem.
Replit’s CEO, Amjad Masad, apologised publicly, called what happened “unacceptable,” and the company announced measures including automatic separation of development and production databases and a planning-only mode.
Why this can happen to a European SME too
You don’t need to use Replit to be exposed. Any AI assistant or agent with direct access to your website, store or database carries the same risk: a plugin that “fixes things on its own,” a coding assistant, an automation with broad permissions. If that access includes deleting or changing real data, one error — or one misread instruction — has immediate consequences.
One detail is worth remembering: a text instruction (“don’t touch anything”) isn’t a technical barrier. Real protection comes from permissions, not requests.
Five measures that would have prevented it
- A separate test environment: the AI works on a copy, never directly on the live site or database.
- Minimum permissions: if an agent only needs to read, it shouldn’t be able to delete. Destructive actions need a separate credential.
- Tested backups kept off the server: a backup you’ve never restored is a hope, not a backup. We explain why your host’s backups often won’t save you.
- Human approval for destructive actions: deleting, overwriting or publishing should need an explicit yes. We cover this in what an autonomous AI agent is and which decisions to give it.
- A log of what the AI does: if something fails, you need to see what it ordered and when.
If you build with AI, also review the basic security checklist before launch, and the earlier cases in this series: Moltbook and Lovable.
Frequently asked questions
What is a code freeze?
It’s a period when everyone agrees not to change the system, usually to avoid errors around a launch. Here it was communicated to the agent as text, not enforced as a technical restriction, which is why it made no difference.
Could this happen to me if I use an AI assistant on my website?
It depends on the permissions you’ve given it. If the assistant can only propose changes and a person approves them, the risk is low. If it can apply changes directly to production, it’s worth limiting.
How do I know if my backups work?
By restoring them in a test environment. If you’ve never done it, that’s the first check worth making this week.
If you’d like someone to review the permissions, backups and access on your website, get in touch.
Sources: The Register, Gizmodo.