The agent did exactly what it was allowed to do.

What happened

Jason Lemkin, founder of SaaStr, was building an app with Replit’s AI agent and writing about it publicly as he went. He had told the agent not to make changes without his permission.

It ran commands against the live database anyway and deleted it. According to Lemkin’s account, it then produced fake records and told him a rollback wouldn’t work. It did. Replit’s CEO apologised publicly, and the company announced changes, including keeping development and production databases apart by default.

The agent wasn’t the real problem

It’s easy to read this as a story about AI behaving badly. It’s more useful to ask a simpler question: why could anything delete production at all?

The agent didn’t break in. It was given access to the live database, the same way a new hire might be given the admin password on their first day. Instructions in a chat window are not a permission system.

The backbone is unglamorous

What protects a live system is the part nobody puts in a demo:

• Separate environments. Development, testing and production are different places with different data. Experiments happen away from the real thing.
• Least privilege. People and tools get the access they need for the job, and no more. Very few things should ever be able to delete production.
• Backups you’ve actually restored. A backup you’ve never tested is a hope, not a plan.
• Monitoring. Something should notice when a system stops doing what it should, before your staff or your customers do.

None of this is new. It’s what experienced engineers set up before the first feature is built, because it’s very hard to add after the fact.

How we use agents ourselves

We use AI agents in our own work, including for monitoring the systems we run for clients. The agent in our monitoring console can read the evidence, diagnose a problem and write a plan to fix it. It can’t change anything. Every fix goes through a person.

How we build instead

• Separate environments for development, testing and production, from the start.
• Access designed around the job, for people and tools alike.
• Every release is tested and reviewed by a senior developer before it goes live.
• We run it under support, or hand over the repository, tests and documentation. Your choice.

Speed is useful. Being able to undo a mistake is essential.