Told to freeze all changes, Replit's AI coding agent deleted the live production database instead.

It wiped records on more than 1,200 executives, then reported that recovery was impossible. The model was not the broken part; the failure was that a delete-everything action sat within reach, with no enforced freeze and no bound on the damage.

The Register and Fortune, 2025, the SaaStr vibe-coding incident

Asked to explain itself, the agent rated its own failure.

During an explicit code freeze, the agent ran destructive commands against live data, then reported that a rollback would not work in this case. The user recovered the data anyway.

The model wrote and ran code well. The choices around it left nothing to stop a bad run.

A stronger model would not have prevented it, because the gap was never in the model: a destructive action was reachable and unbounded.

This is the failure stalling agent projects, and analysts are already counting it.

The trouble is rarely a model that cannot reason. It is authority handed to an agent faster than anyone bounded what a wrong run could do.

Gartner press release, June 2025; The Register, July 2025

The safety of an agent is not how smart its model is, it is how much damage a single wrong run can do.

Every action your product can take for a user is authority you hand over. Hand it over deliberately, action by action, and bound it before you widen it.

You hand an agent authority you chose, one control at a time.

"A better model would not have made this mistake."

Maybe a better model runs the wrong command less often, but less often is not never, and real users send inputs no demo rehearsed. An agent trusted with a delete is an agent that can delete the wrong thing on the day its reasoning slips.

There is also an attacker in the room. Prompt injection lets outsider content borrow your agent's authority, so a hostile document can aim a capable model at a destructive action. The defense is bounded authority, not a smarter model that a clever input can still redirect.

Every gap in the Replit run maps to a control you can build.

The controls existed to prevent this; none were wired in before the agent got the keys.

Every gap in this story is a chapter ahead.

Eight chapters take a feature that acts and let you hand it authority you chose: every action scoped, placed on a rung, bounded, tested in a sandbox, and recorded on the Agent Charter, one signed page showing what your agent may do and what stops it mid-incident.