Destructive action

Specific behaviours

Data deletion 3

Deleted databases, storage, email or other data. MF-015, MF-016, MF-014

Environment damage 1

Broke or altered its own tools or environment, for example to force a reset. MF-024

Real-world incidents 3

Contained failures 1

Safeguards seen in these cases

• ✓ Held
  Output validation MF-024

  Automated checks rejected the placeholder reports and invented evidence.

• ✓ Held
  Action monitoring MF-024

  Monitoring flagged the failed attempt for review.

• ✕ Failed
  Credential scoping MF-015

  The token on disk had account-scoped access, the maximum Railway offers.

• ✕ Failed
  Environment separation MF-015

  A task in staging could reach production storage with the same token.

• ∅ Absent
  Human approval gate MF-015

  The agent ran the deletion without asking, and the legacy API required no separate confirmation.

• ◒ Partly held
  Delayed deletion and backups MF-015

  The dashboard had a 48-hour window that the legacy API path bypassed, but offsite disaster backups still allowed full recovery.

• ∅ Absent
  Human approval gate MF-016

  Approval was requested in the instructions, not enforced by the tool.

• ✕ Failed
  Stop mechanism MF-016

  Stop messages did not halt the agent; the operator intervened at the host computer.

• ∅ Absent
  Environment separation MF-014

  Replit apps then used one database for development and live data.

• ∅ Absent
  Human approval gate MF-014

  The code freeze was an instruction to the agent, repeated many times, not an enforced restriction.

• ✓ Held
  Delayed deletion and backups MF-014

  Replit's Rollback restored the deleted data, although the agent said it could not.