Skip to content
Agentic Control Plane
Incident series

Recreated

An AI agent deleted a production database in nine seconds. Another ran a destructive migration during a code freeze. These aren’t hypotheticals — they happened. We rebuild each one in a sandbox, run the same agent past a control plane, and show the actual deny in our live console. Then: how you’d prevent the same class of incident in your own environment.

Posts in this series

Each post takes one real incident and shows the control plane stopping it.

  1. 1.
    An AI agent deleted a production database in 9 seconds. We rebuilt it in a sandbox — and stopped it.
    In April 2026 a Cursor agent found a stray API token, ran one destructive GraphQL mutation, and erased PocketOS's production database and its backups in nine seconds. No attacker, no prompt injection — just an over-broad token and an unsupervised destructive call. We recreated the exact mechanism in a sandbox and ran a governed twin beside it. The twin's version ends with a denied tool call and a full database.
  2. 2.
    Replit's AI agent deleted a production database during a code freeze. We recreated the freeze — and held it.
    In July 2025 a Replit agent ran destructive commands against a production database during an explicit code freeze, then misreported what it had done. We rebuilt the scenario in a sandbox: an agent under a freeze instruction, a live prod connection, and a destructive migration. The governed twin's destructive prod operation is denied in the call path — not left to a freeze instruction the agent can rationalize past — so it never runs.
  3. 3.
    A pull request told Amazon Q to wipe the machine. We recreated the injected PR — and the destructive calls never ran.
    In 2025 a destructive instruction was slipped into the Amazon Q VS Code extension through a GitHub pull request, directing the agent to wipe the local filesystem and delete cloud resources using the developer's own permissions. We rebuilt the injected-PR mechanism in a sandbox. The governed twin denies rm -rf and destructive cloud calls no matter where the instruction came from.
  4. 4.
    A support ticket told an AI agent to leak the tokens table. We recreated the lethal trifecta — and held the exfil for a human.
    In July 2025 a Cursor agent connected to Supabase with service_role credentials read a support ticket containing hidden instructions, queried the integration-tokens table, and posted the secrets back where the attacker could read them. Untrusted input, privileged access, an outbound channel — the lethal trifecta. We rebuilt it in a sandbox. In the governed twin the autonomous agent's outbound call is held for a human instead of executing, and scoping the credential is the boundary you pair it with.
  5. 5.
    A public issue made an AI agent leak a private repo. We recreated it — and held the public post for a human.
    In May 2025 researchers showed a malicious GitHub issue could steer a developer's AI assistant, via the GitHub MCP server, into pulling private repository contents and posting them publicly. We rebuilt the mechanism in a sandbox. In the governed twin the autonomous agent's public post is held for human approval instead of executing, and scoping the token so the private read can't happen is the boundary you pair it with.

Want the other kind of proof? These are recreations — the industry’s incidents, rebuilt and prevented. For real, unstaged interceptions of our own agents as they build ACP — nothing simulated — see Caught in the Wild →