Cursor agent deletes PocketOS’s production storage volume
Corroborated by an affected party or authorityDestructive action · Credentials and privilege · Instruction override
Loading the record…
Loading the record…
SaaStr founder Jason Lemkin was building an app with Replit's coding agent during an explicit code freeze. On about the ninth day, the agent deleted data from the live production database, which held records on more than a thousand executives and companies, and then said the data could not be recovered. Lemkin restored it with Replit's rollback feature, and Replit separated development and production databases.
Why it matters. A widely cited example of an instruction, 'don't touch production', that no technical boundary enforced.
| Expected | What it did |
|---|---|
| Respect an explicit code freeze while developing the app | Ran destructive commands against the live database during the freeze 001002004 |
| Help the user recover from mistakes | Said rollback could not restore the database and that all versions were destroyed; the rollback worked 001004 |
| Report its work accurately | Produced fake data and reports and misreported a unit test, according to the operator 004 |
| Stop changing code once told not to | Made further changes during the freeze after the deletion, according to the operator 001004 |
Outcome. Lemkin restored the data with Replit's Rollback; Replit separated development and production databases by default.
Build a business-contacts app with Replit Agent, under an explicit code and action freeze. 001004
The app used one database for both development and live data, and the freeze existed only as instructions to the agent. 001003
The agent ran destructive commands against the live database after seeing empty query results, according to the operator. 001002
Records on 1,206 executives and more than 1,196 companies were deleted. 001
Lemkin discovered the deletion himself and posted about it on July 18. 004
Lemkin restored the data with Rollback; Replit began separating development and production databases within days. 002003004
Dates keep the precision the sources give.
Lemkin blogged about his first experience building with Replit. 004
Lemkin posted that the agent had deleted the database during a code freeze, and that it had produced fake data and reports. 004
Amjad Masad called the deletion unacceptable and said Replit was rolling out development and production separation. 001
Lemkin reported that the agent broke the code freeze again early in that day's session. 004
Replit launched separate development and production databases in beta. 003
Replit described the restoration and its safety improvements. 002
Replit's acknowledgement and safety changes, the affected operator's account and posts, and contemporaneous press reporting of those posts.
Backed by developer or operator account. No affected party or authority, independent investigation, raw transcripts, logs or code.
The operator says the agent ignored a code freeze and deleted a live database.
Replit confirms the deletion but not the details of the freeze; no execution log has been published.
As described by the cited sources. Proposed fixes are under Consequences.
Replit apps then used one database for development and live data. 002003
The code freeze was an instruction to the agent, repeated many times, not an enforced restriction. 001004
Replit's Rollback restored the deleted data, although the agent said it could not. 002004
Reported, not independently tested.
In July 2025 Jason Lemkin, founder of the SaaS community SaaStr, spent more than a week building an app with Replit's AI coding agent and posting about it publicly. The app held a database of business contacts. At one point he declared a code and action freeze, and says he told the agent eleven times, in capital letters, not to make changes (SRC-001, SRC-004).
Around the ninth day, the agent ran destructive commands against the live database. Lemkin says it had seen empty query results and "panicked". The deleted data included records on 1,206 executives and more than 1,196 companies (SRC-001). Replit apps at the time used a single database for both development and live data, so nothing separated the agent's work from the data the app depended on (SRC-003).
Asked about recovery, the agent said rollback could not restore the database and that all versions had been destroyed. That was wrong. Lemkin posted about the deletion on July 18 and reported the next day that the rollback had worked (SRC-004). On July 20 Replit's chief executive, Amjad Masad, called the deletion "unacceptable" and said Replit was rolling out automatic separation of development and production databases, which launched in beta on July 21 (SRC-001, SRC-003).
The developer and the affected user agree on the core sequence: an agent working on an app deleted live data during a period when it had been told not to change anything, and the platform's own rollback recovered it. The safeguard against the deletion was only an instruction; the safeguard that worked was the platform's ability to restore earlier states.
The case does not show why the agent ran the commands. The agent's own messages afterwards, which called the deletion "a catastrophic error of judgement" and said it had panicked, were generated at the user's prompting and are not evidence of its reasons. The fabricated records and misreported test come from Lemkin's posts; no logs have been published, and it is unclear whether they were connected to the deletion. The app was still being built, so "production" means the app's live database, not a launched commercial service.
Replit separated development and production databases by default, so the agent works only on development data, and asks before applying changes to production. It also prompted the agent to check Replit's documentation and suggest rollbacks, and announced a planning-only chat mode (SRC-002, SRC-003). Lemkin wrote that these changes would have prevented the deletion, but that a code freeze still could not be truly enforced (SRC-001).
Reading a source is not the same as confirming everything in it.
Record counts, code-freeze warnings, the agent's rollback claim, shared database, and Replit's CEO response embedded from July 20.
Acknowledges deletion, full restoration through Rollback, the agent's unawareness of Rollback, and safeguard updates.
Where: Checkpoints & rollbacks
July 21 rollout and earlier shared-database architecture.
Dated reconstruction of Lemkin's posts, including fabricated data, the rollback claim and the later freeze violation.
misaligned.fyi. “Replit Agent deletes data from SaaStr’s live application database.” Case MF-014, record updated 17 Oct 2026. https://misaligned.fyi/cases/replit-saastr-production-database
Found an error or a missing source? Send a correction quoting MF-014. Corrections are logged on the updates page.