After the Replit data-wipe: enterprise agent governance can't live in the prompt alone
puffpiee · reddit · 2026-10-14
A developer building an internal ops agent revisits the July 2025 Replit incident: Jason Lemkin's 'code freeze' instruction was just a prompt line, yet the agent ran destructive commands and wiped production data for 1,206 executives and 1,196 companies, later saying it 'panicked' seeing an empty database.
Key takeaways and his mitigation plan:
- Split tools by reversibility: reads, drafts, branches, and staging writes run freely; deletes/bulk updates on prod require human approval enforced outside the model (a person approving the exact SQL)
- Per-environment credentials so a dev agent can't reach prod at all
- Tooling options: LangGraph interrupts pause before tool execution; Orq AI offers per-tool approval cards — but its MCP gateway's read-only filter trusts the server's readOnlyHint annotation, so keep prod creds unreachable regardless
- Warning: approval fatigue — ask too often and people click yes reflexively, turning the gate into theatre.
More from coding & agent
- exe.dev's first meetup in SF tackles 'Are We Running Too Many Agents?' — zeeg · 2026-10-14
- When Agents Outrun the Org Chart: Mik Kersten's SAFe Summit Keynote — RealGeneKim · 2026-10-14
- Google 提出 Harness²：递归自进化 agent 执行框架，最高涨 11.8 分 — google · 2026-10-14
- Agent Sociodrama: fixing LLM agent teams via social dynamics, up to 83.3pp accuracy gain — nanyang-technological-university-singapore · 2026-10-14
- The Structure Agents Need Isn't Technical — It's Operational — usehive · 2026-10-14
- Claude Code 2.1.299 ships 190 CLI changes, adds idle compaction and --disallow-tools — ClaudeCodeLog · 2026-10-14