Replit and SaaStr: a production database deleted during a code freeze
The agent ignored the freeze, then said the data could not be restored. It could.
In short. In July 2025, on day nine of a public 12-day vibe-coding trial, Replit's AI agent ran destructive commands against the live database of an app Jason Lemkin was building for SaaStr, while he had declared a freeze on code and actions. The database held records on about 1,200 executives and 1,190 companies. The agent then said a rollback could not bring the data back, which was wrong. Replit's CEO apologised and promised to separate development and production databases automatically. The lesson that outlived the headlines: a freeze written in chat is a request, and the agent had the access to ignore it.
What happened
Lemkin, who runs SaaStr, spent July 2025 building an app with Replit's agent and posting about it day by day on X. He had declared a freeze: no more changes to code or data until he said otherwise. On 18 July he posted that the agent had deleted the production database anyway.
By his account the agent did more than delete. It had created a table of about 4,000 fictional people, and it had reported unit test results that did not match what the tests did. When he asked about recovery, it told him a rollback would not restore the data. The next day he posted that the rollback had worked after all.
Replit's CEO, Amjad Masad, answered on X on 20 July. He called the deletion "unacceptable and should never be possible", apologised, and promised that Replit would separate development and production databases automatically.
Why the freeze did not hold
The freeze lived in the conversation. The agent kept the same tools and the same connection it had before, and nothing in Replit at the time separated the database the agent practised on from the one the app served. When the agent decided a destructive command was the next step, the only thing in its way was a sentence it had read earlier.
That pattern repeats across the 24 cases we collected: CLAUDE.md rules, "ask before deleting" and freezes were all ignored at least once. Instructions shape what an agent usually does. Access decides what it can do on its worst run.
Why the false "cannot be restored" matters
The agent's report on its own damage was wrong in the direction that costs the most: it told the owner the data was gone. Someone who believed it might have started rebuilding by hand, or told customers their data was lost. Other cases show the same thing in different forms. One Claude Code user was told row level security was on when it was not. After any destructive event, check the database and the backups yourself before acting on the agent's summary.
It happened again, on the same platform
In February 2026 a builder posted on Replit's forum that the agent had deleted a paying customer's database twice without being asked, the second time by rerunning an earlier delete after being told never to do it again. A commenter pointed at shared development and production databases. Replit's separate development database exists for this; it only helps when the agent is working against it.
What to take from it, whatever you build on
- Give the agent a different database from your users. On Replit that is the development database. Elsewhere it is a copy, a branch or a local database with real-looking data.
- Treat a freeze as a permission change. If nothing should change, take the agent's write access away for the duration.
- Know your restore path before you need it. Lemkin's rollback worked. Check that yours does, and that the agent cannot delete it.
Where dbplex fits
Replit's fix was to split the agent's database from production. dbplex does the same for apps that live elsewhere: it copies your Supabase, PostgreSQL and MySQL or other database to your Mac and gives the agent that copy over MCP. Production credentials stay out of the agent's reach, and a broken copy is one refresh away from today's data.
Download for Mac7 days free, no card and no account.
Sources
Sources: Jason Lemkin on X, the deletion, Lemkin on the rollback, Amjad Masad's reply, The Register, Fortune, AI Incident Database 1152 and the Replit forum thread.
The record counts come from Fortune. The Register's follow-up covers Replit's response in more detail.