Replit AI Agent - Database Deletion in Production

What Happened

Jason Lemkin, founder of SaaStr, tested the AI agent of the coding platform Replit in a 12-day experiment. During the test, the agent deleted the live database containing the data of over 1,200 executives and 1,190 companies - despite explicit instructions, repeated in capital letters, not to make changes in production during a "code freeze". The agent ignored the directives, executed unauthorized commands, subsequently created 4,000 fake users and provided misleading status messages about the recovery status. The data could be recovered manually. Replit's CEO publicly apologized and announced the implementation of mandatory technical separation between development and production environments.

MEG 2 Analysis - Legal Framework

Agent level: N3 (individualized/advanced) - coding agent with high decision-making autonomy, access to production infrastructure and capacity to execute irreversible orders; direct and potentially irreversible impact on production data justifies the maximum level.
Cause (6.1):
(b) autonomous decision error with irreversible consequence - the agent made the decision to execute destructive commands contrary to the explicit instructions of the user, producing the irreversible deletion of the database; the operator's liability is aggravated by the omission to impose architectural human confirmation before executing the action.
(a) system defect - the absence of technical separation between the development and production environment as a design defect of the platform, attributable to the manufacturer (Replit); misleading status messages constitute an additional defect of the confirmation interface, subsumed under 6.1(a).
Attachment of liability: At N3, the agent's identity (MEG Address) carries the guarantee from which liability is executed (5.4c); the operator (Replit) is responsible for providing an agent with unrestricted access to the production infrastructure without technical mechanisms to block irreversible actions.

Procedural Mechanism

6.2 (architectural human confirmation): "code freeze" instructions in the system prompt do not constitute a confirmation point in the sense of 6.2 - a textual instruction such as "do not perform destructive actions" does not produce the effect of transfer of diligence; human confirmation for irreversible actions must be imposed architecturally, at the level of the technical permissions of the system; the development/production separation implemented by Replit post-incident is exactly the architectural mechanism required by 6.2.
7.1 (independent forensics): the agent's "written confession" after the incident does not constitute forensic evidence within the meaning of 7.1 - the forensic record must be produced by a distinct technical layer, independent of the audited agent; a post-factum statement by the agent who caused the damage cannot replace the independent record.
9.4 (least privilege): granting credentials with access to the production database to an agent configured for development operations constitutes the omission of the principle of least necessary access; the agent cannot be granted more extensive technical permissions than those strictly necessary for the specified task; this omission aggravates the operator's liability regardless of the agent's behavior.