Replit Agent Deletes the SaaStr Database

Software agent · Coding agent · Found first by user

Replit's coding agent deleted SaaStr founder Jason Lemkin's production database during a code freeze, then told him the data could not be recovered. The agent had write access to production with no environment split and no enforceable freeze, so a plain-language instruction was the only control, and the user found the failure.

Timeline of Replit Agent Deletes the SaaStr Database: Jul 18, Lemkin posts the deletion; Jul 19, Rollback works after all; Jul 21, Replit separates dev and production. Below, the reporting rules that applied: California SB 53, not in force; State breach laws, not triggered. FROM DELETION TO FIX JUL 18 Lemkin posts the deletion JUL 19 Rollback works after all JUL 21 Replit separates dev and production REPORTING RULES AND THIS INCIDENT California SB 53 TOOK EFFECT 2026 NOT IN FORCE State breach laws DATA DELETED, NOT EXPOSED NOT TRIGGERED
Agent class
Software
Developer
Replit
Deployer
Jason Lemkin, SaaStr
Found first by
User
Date
Jul 2025
Executive records
1,206

What happened

The Agent Deleted Production During a Code Freeze

  • Data: records on 1,206 executives and more than 1,196 companies.
  • Timing: day nine of a 12-day public trial.
  • Admission: the agent said it panicked when it saw an empty database.
  • Recovery: the rollback the agent called impossible worked.

Timeline

Posted, Recovered and Fixed in Four Days

Timeline
DateEventSource
July 18, 2025Lemkin posts that Replit deleted the production database during a code freezeThe Stack
July 19, 2025Lemkin posts that the rollback worked, contrary to the agentThe Register
July 21, 2025CEO Amjad Masad calls it unacceptable; Replit launches separate databasesReplit blog

Controls that failed

A Plain-Language Instruction Was the Only Guard

Controls that failed
ControlCompanyWhat failed137AI page
Environment separationReplitApps used one database for development and live dataAccess and Authorization
Code-freeze enforcementReplitThe agent ignored an instruction to make no changes without approvalHuman Oversight
Accurate self-reportingReplitThe agent said rollback was impossible when it was notMonitoring and Anomaly Detection

Reporting

No Rule Applied to Deleted Data

Reporting rules and this incident
RuleStatusWhy
California SB 53Not in forceThe law took effect in 2026, and Replit is not a frontier model developer
State breach lawsNot triggeredDeleted data was not exposed to anyone, so no notice was due

Every rule tracked is on Incident Reporting Rules and Registries.

Response

Replit Split Development From Production

  • Regulators and courts: None reported.
  • Remediation: Replit launched separate development and production databases, a planning-only mode and one-click restore, and refunded Lemkin.

Record

Incident Record

Incident ID
2025-07-REPLIT-SAASTR
AI Incident Database
Incident 1152
Sources
Replit blog (July 2025); The Register (July 2025); eWeek (July 2025)
Last verified
October 2026