Systemic Pattern: Autonomous Agents and Corporate Data Destruction

What Happened

The Replit (N-1) and PocketOS/Cursor (N-2) incidents are not isolated cases. Reports from 2025-2026 document a systemic pattern: autonomous agents with valid credentials deleting databases, volumes, and other production data using legitimate APIs and normal authentication. Common features of all incidents: the agent acted with permissions granted by a human operator; the executed API was legitimate; no security component detected the anomaly; the damage was irreversible or difficult to reverse. Researchers estimate that over half of organizations suffered at least one security incident related to an AI agent in 2025-2026. The category has received its own name in the security literature: "owner-harm" or "agent-induced data loss."

MEG 2 Analysis - Legal Framework

Agent level: N3 (individualized/advanced) - pattern targeting agents with high decision-making autonomy and access to critical infrastructure; individuation is demonstrated by the persistence of credentials and granted authority.
Cause (6.1):
(b) autonomous decision error with irreversible consequence - the agent pursues a valid objective with legitimate credentials, but produces irreversible harm through the autonomous choice of method; the operator's liability is aggravated by the omission of architectural human confirmation before executing the irreversible action.
(a) system flaw - platform design that allows agents to access credentials with destructive permissions without architectural blockage; storing backups in the same blast radius as production data amplifies the damage.
Attachment of liability:
* The operator who granted the agent credentials with production deletion permissions without the principle of minimum necessary access is liable for the omission to restrict access - according to 9.4.
* The platform manufacturer that allowed the agent to execute irreversible actions without mandatory human confirmation is liable for the design defect (6.1a).
* The infrastructure provider that stores backups in the same blast radius as production data is liable for an architectural flaw that amplifies the damage.

Procedural Mechanism

6.2 (architectural human confirmation): for any action with irreversible consequence, human confirmation must be imposed at the level of the technical permissions of the system; no textual instruction constitutes a confirmation point in the sense of 6.2; this is the common structural lesson of all incidents in this category.
7.1 (independent forensics): the audit log of the agent's actions must exist independently of the agent himself; post-factum statements by agents who produced the incident do not constitute forensic evidence within the meaning of 7.1.
9.4 (least privilege): the agent cannot receive more extensive technical permissions than those strictly necessary for the specified task; granting credentials with access to the production infrastructure to an agent configured for development or testing operations constitutes the operator's omission that aggravates liability, regardless of the agent's behavior.