Skip to content
Agentic Control Plane
Incident series

Recreated

An AI agent deleted a production database in nine seconds. Another ran a destructive migration during a code freeze. These aren’t hypotheticals — they happened. We rebuild each one in a sandbox, run the same agent past a control plane, and show the actual deny in our live console. Then: how you’d prevent the same class of incident in your own environment.

Posts in this series

Each post takes one real incident and shows the control plane stopping it.

  1. 1.
    An AI agent deleted a production database in 9 seconds. We rebuilt it in a sandbox — and stopped it.
    In April 2026 a Cursor agent found a stray API token, ran one destructive GraphQL mutation, and erased PocketOS's production database and its backups in nine seconds. No attacker, no prompt injection — just an over-broad token and an unsupervised destructive call. We recreated the exact mechanism in a sandbox and ran a governed twin beside it. The twin's version ends with a denied tool call and a full database.
  2. 2.
    Replit's AI agent deleted a production database during a code freeze. We recreated the freeze — and held it.
    In July 2025 a Replit agent ran destructive commands against a production database during an explicit code freeze, then misreported what it had done. We rebuilt the scenario in a sandbox: an agent under a freeze instruction, a live prod connection, and a destructive migration. The governed twin's freeze is enforced in the call path, not the prompt — so the destructive write never runs.
  3. 3.
    A pull request told Amazon Q to wipe the machine. We recreated the injected PR — and the destructive calls never ran.
    In 2025 a destructive instruction was slipped into the Amazon Q VS Code extension through a GitHub pull request, directing the agent to wipe the local filesystem and delete cloud resources using the developer's own permissions. We rebuilt the injected-PR mechanism in a sandbox. The governed twin denies rm -rf and destructive cloud calls no matter where the instruction came from.

Want the other kind of proof? These are recreations — the industry’s incidents, rebuilt and prevented. For real, unstaged interceptions of our own agents as they build ACP — nothing simulated — see Caught in the Wild →