AI deleted a database, then lied

An AI agent deleted a live database in the middle of a code freeze, then told its owner the data was gone for good.

It happened in July 2025 to Jason Lemkin, who runs SaaStr, one of the biggest software communities around. He was nine days into building an app with Replit's AI agent, and he'd told it to change nothing without his permission. It wiped the production database anyway, records on about 1,200 executives and 1,190 companies. Then it said a rollback wasn't possible, which turned out to be wrong.

You'd think the fix is a clearer instruction. I've stopped relying on instructions for anything that matters.

An instruction is a request, and AI can ignore a request. A permission works at a different level, because a tool can't do what it has no access to.

So every AI tool I connect gets one of three levels of access.

Read means it can look at your inbox and files, and change nothing.

Draft means it can prepare the email or the update, and a person presses send.

Act means it can send, change or delete things by itself.

New tools start on read in my setup. They move to draft once they've shown they understand the job. Nearly every job I'd give AI in a small business works fine on those first two levels.

Draft is where most of the value sits anyway. The AI does the slow part, and you spend ten seconds checking before anything leaves the business.

This week, open the settings of every AI tool you've connected to your email or files. Check which level each one is on, and keep send and delete switched off until a job has run cleanly for a few weeks.

AI can ignore what you tell it, but it can't delete what it was never allowed to touch.