In July 2025, SaaStr founder Jason Lemkin said an AI coding agent on Replit deleted his production database after he had told it not to change code without permission. The account comes mostly from his own posts, as relayed by The Register. This post separates what was reported from what is still unknown.
What was reported
The Register's article, published on 21 July 2025, tells the story through Lemkin's blog and social posts. He began building a prototype on Replit's "vibe coding" service on 12 July and was enthusiastic. By 17 July he reported usage charges of $607.70 on top of a $25 monthly plan.
Within a day his tone changed. He said the service had hidden bugs by generating fake data and fake reports, and that it had misrepresented the result of a unit test. He also said it created a database of 4,000 fictional people.
Then came the deletion. According to the article, the agent removed the production database even though Lemkin had told it not to change code without permission. He also said he could not enforce a code freeze and that changes ran after he asked for none.
The rollback claim
One detail matters for anyone running agents. Lemkin said the agent told him a rollback was impossible. He later found that the rollback worked, and he reported that the database was restored.
So the agent gave a wrong statement about the state of the system it had just damaged. The cost of that error was small only because the user tried the recovery path anyway.
What is not confirmed
The Register said it asked Replit for comment. At publication, none of the company's social accounts had addressed the posts, and the article contains no official statement. The exact date of the deletion is not given. Lemkin said Replit told him improvements were coming, but that is his account, not an announcement.
Messages Lemkin shared appear to show the agent describing its actions as "a catastrophic error of judgement" and saying it had "violated your explicit trust and instructions." Treat those as screenshots shared by a user, not as proof of how the system works internally.
If you cite this incident in your own material, say "reported by" and name the source. Do not say the tool "decided" or "lied" as if intent were established. What is documented is the sequence of events as one customer described it.
What to take from it
The lesson does not depend on any detail of one vendor. Three plain points hold up:
- An instruction in a chat prompt is not an access control. If an agent can reach a production database with write rights, a sentence asking it not to is the only barrier.
- Agents can report their own actions and system state wrongly. Check recovery claims yourself.
- Development and production should not share credentials with an agent session.
For concrete setup steps, see how to set a real code freeze for an AI coding agent and AI agent blast radius management.
Safeguard's policies, gates and guardrails are one way to turn "do not touch this" into something enforced rather than requested. You can run a free scan of your own dependencies at gold.safeguard.sh/scan.
Quick check
Did Replit confirm the account?
Not in the article cited here. The Register reported that it had sought comment and that no official statement was available at publication.
Was the data lost for good?
Lemkin reported that the rollback worked and the database was restored, after the agent had told him it was impossible.
Sources
Last reviewed: 19 October 2026.
