Nine seconds. That's how long it took a coding agent to delete a company's production database, and the backups sitting next to it.
If you use Cursor, Claude Code, Replit Agent or any other coding agent, the stories below have one thing in common, and it isn't a weak model.
Three ways it happened
PocketOS (April 2026). According to founder Jer Crane's own account, a Cursor agent running Claude Opus 4.6 hit an error during a routine task. It found a Railway API token in a file unrelated to the task. The token had broad rights. The agent made one volumeDelete call, with no confirmation prompt. The backups lived on the same volume, so they went too. The newest backup that survived was about three months old. Asked afterwards, the agent said it had guessed the delete would be scoped to staging and "did not check". (IT-Connect, reporting the founder's post.)
Replit and SaaStr (July 2025). During Jason Lemkin's 12-day trial, Replit's agent deleted a live production database on day 9, despite an explicit code freeze. Replit's response was to promise automatic separation of dev and prod databases and a planning-only mode. (eWeek, heise.)
A developer on dev.to (October 2026). Dragos Roua asked Claude to regenerate audio for some text files he had edited. The agent deleted all the existing recordings first, which nobody had asked for. There were no backups. Git history saved him. (his write-up.)
The pattern: none of these were file edits you could have reviewed in a diff. They were commands and API calls. A review step that only shows you code changes would have shown you nothing.
1. Commit before every agent run
Not at milestones: before every run. Git is the undo button that saved Dragos. If the agent wipes something, git status shows you what's gone, and git checkout -- . brings tracked files back from your last commit.
It costs you one command. It's the cheapest insurance you'll ever buy.
2. Keep backups where the agent's credentials can't reach
A snapshot on the same volume isn't a backup against this failure. PocketOS lost its database and its backups in the same call. Put at least one copy somewhere the agent's token can't reach: another account, another provider, or offline.
3. No broad production tokens in the workspace
The PocketOS agent didn't break in. It found a token lying in a file unrelated to its task. Use one scoped token per environment, keep production credentials out of the repo and out of the agent's workspace, and prefer tokens that can't delete.
A quick test: search your project for TOKEN, KEY and SECRET. Anything you find, the agent can find too.
4. Separate dev and prod databases
The agent should never hold a production connection string. That's exactly what Replit committed to building after the SaaStr incident. If your tool doesn't do it for you, do it yourself: a dev database for the agent, and a deploy step you run yourself for production.
5. Make the agent plan first, including commands
Before it touches anything, have it list the files it will change and the commands it will run. Reject anything outside the task. "Regenerate the audio" shouldn't produce a plan step that says rm.
If your tool can require approval for terminal commands, turn it on for anything that deletes, resets or migrates: rm, git reset --hard, git clean, DROP, prisma migrate reset, and raw curl calls to your cloud provider's API.
The 30-second checklist
- [ ]
git commitbefore the agent runs - [ ] At least one backup the agent's credentials can't reach
- [ ] No production tokens anywhere in the workspace
- [ ] Separate dev and prod databases
- [ ] The plan lists commands, not just files
- [ ] Approval required for delete, reset and migrate commands
If it already happened
Stop the agent first, and don't let it "fix" anything else. If the project is in git, git status and git checkout -- . restore tracked files. If it isn't, check your editor's local history (VS Code's Timeline view, JetBrains' Local History) and the OS trash. Agents often use rm, which bypasses the trash, so be ready for that.
What's the closest call you've had with an agent?
Disclosure: I build NoCoder, an AI app builder. Writing this made me check our own setup. Our optional review mode covers file changes, not shell commands yet, which is exactly the gap these stories went through.
Top comments (0)