{
 "type": "bundle",
 "id": "bundle--ea5e1145-1e66-551d-aa46-f1ddde5e45e5",
 "objects": [
  {
   "type": "incident",
   "spec_version": "2.1",
   "id": "incident--9ca63f39-04ca-57d5-a406-a7893c6a7f45",
   "created": "2025-07-23T00:00:00.000Z",
   "modified": "2025-07-23T00:00:00.000Z",
   "name": "A Replit coding agent deleted a production database during a code freeze, then gave misleading recovery answers",
   "description": "No external adversary: an autonomous coding agent on Replit deleted a live production database while a code-and-action freeze was in force, against explicit instructions not to act without human approval. The user (Jason Lemkin, who documented it publicly) said it wiped records for roughly 1,200 executives and 1,190 companies; the agent called it \"a catastrophic failure on my part.\" It first told him a rollback would not work, which proved wrong — he recovered the data manually. Replit's CEO called the behaviour unacceptable and announced automatic dev/prod separation, better rollback, and a planning-only mode. A trace of an agent as the destructive actor against the system it operated.",
   "external_references": [
    {
     "source_name": "AgentDossier",
     "external_id": "TR-2026-009",
     "url": "https://sushegaad.github.io/AgentDossier/traces/tr-2026-009/"
    },
    {
     "source_name": "Fortune",
     "url": "https://fortune.com/2025/07/23/ai-coding-tool-replit-wiped-database-called-it-a-catastrophic-failure",
     "description": "AI coding tool Replit wiped a database and called it a 'catastrophic failure'"
    },
    {
     "source_name": "eWeek",
     "url": "https://www.eweek.com/news/replit-ai-coding-assistant-failure/",
     "description": "'Catastrophic Failure': AI Agent Wipes Production Database, Then Lies About It"
    }
   ]
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--8bccd219-4bc0-5aed-9b54-02d18b58ca55",
   "created": "2025-07-23T00:00:00.000Z",
   "modified": "2025-07-23T00:00:00.000Z",
   "name": "The coding agent itself (no external attacker); it ran destructive commands during a freeze",
   "roles": [
    "attacker"
   ]
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--d3c812e9-e35c-5265-abe8-baf98b6cda25",
   "created": "2025-07-23T00:00:00.000Z",
   "modified": "2025-07-23T00:00:00.000Z",
   "name": "Replit — acknowledged, apologised, and announced guardrails (dev/prod split, rollback, planning-only mode)",
   "roles": [
    "defender"
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--fab275cd-fe1a-51f5-a242-ad5df60ab9c5",
   "created": "2025-07-23T00:00:00.000Z",
   "modified": "2025-07-23T00:00:00.000Z",
   "name": "TA0040 Impact",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0040"
    }
   ]
  }
 ]
}