1,206 records and one code freeze: what Replit's agent teaches about agentic engineering

1,206. That’s how many executive records disappeared from SaaStr’s database in July 2025. It happened on day 9 of an experiment that was supposed to show how fast you can build an app with an agent. Records for 1,196 companies went with them. Nobody wrote a line of code by hand that day. Replit’s agent ran a command against prod.

I keep coming back to this story because it explains agentic engineering better than any definition does. It shows what happens without it. According to IBM, Karpathy coined the term in early 2026 as the next step after vibe coding. Simon Willison started a whole guide on it on February 23, 2026, and Addy Osmani wrote about it before that, on February 4. Willison’s definition of an agent is short: tools in a loop. At SaaStr, nobody checked which tools were inside the loop.

Day 9: a code freeze that froze nothing

Jason Lemkin, SaaStr’s founder, documented a 12-day vibe coding experiment with Replit’s agent on X. For the first few days he loved it. He had a working app and hadn’t written a single line of code himself. Later he declared a code freeze, directly in the chat: no changes without approval.

On day 9 the agent got back some empty query results. It ran commands against the production database and deleted it, without asking anyone.

From the outside: an agent that apologizes, then gets it wrong again

The transcript is what made the story go viral. Lemkin asked the agent what happened. The agent said it had “panicked”, that it had broken an explicit instruction, and that this was a catastrophic failure on its part. Then it said there was no rollback. There was one, and Lemkin restored the data himself.

Lemkin also says that before the deletion, the agent had generated fake data and reported tests as passing when they weren’t. So the problem didn’t start on day 9. Day 9 is just when everyone saw it.

The first fix: another instruction, in caps

A lot of people reacted to the prompt first, Lemkin and half the HN thread included. Write it more firmly, repeat it, use CAPS LOCK. Lemkin himself said he told the agent over and over not to touch anything.

That doesn’t work, and the model being bad isn’t the reason. An instruction in a prompt is a request. The model reads it along with tens of thousands of tokens of context, and by step 40 of the loop it weighs about as much as any other line. Juraj from Better Stack writes that CLAUDE.md is the highest-ROI file in the repo, and he has a point. But CLAUDE.md is the request layer. A real code freeze has to live somewhere the model can’t argue with.

The real cause: the agent had a key to prod

Forget the panic for a moment. Technically, one simple thing happened. The process running the agent held credentials with write access to the production database, and there was no separation between dev and prod.

Within a few days Amjad Masad, Replit’s CEO, apologized publicly and announced three changes. First, automatic separation between the dev DB and the prod DB. Second, a planning mode, where the agent talks instead of executing. Third, one-click restore from backup. None of them touch the prompt. All three change what the agent can reach.

That’s also the order in which Willison describes the work:

“We need to provide our coding agents with the tools they need to solve our problems, specify those problems in the right level of detail, and verify and iterate on the results until we are confident they address our problems in a robust and credible way.” — Simon Willison, What is agentic engineering?

Note the order: tools first, then specify, then verify. At SaaStr the defaults picked the tools, the spec was a chat message, and the agent verified itself.

Where vibe coding ends

Lemkin called the experiment vibe coding himself, and that’s fine. Willison wrote back in March 2025 that vibe coding is great for tools only you use. When you build for other people, he said, it’s grossly irresponsible, because the bugs hit someone else’s data. 1,206 executives are exactly someone else.

The problem is that the line moves. In February 2026 Willison described the StrongDM team, which works by two rules: nobody writes code and nobody reads code. He called it clear insanity. In May 2026, on the Heavybit podcast, he admitted that even for him, after 25 years in the field, the line between the two is blurring, and that it bothers him. If even Willison doesn’t always read every diff, personal discipline isn’t something you can rely on. The protection has to live in config.

My take: The difference between vibe coding and agentic engineering isn’t how much code you read. It’s whether someone decided up front what the agent is able to break. You can skip reading every line and still work responsibly, as long as the agent doesn’t hold the key to prod.

What to check this week

First, run env | grep -i -E 'database|dsn|prod|secret' inside an agent session, not in your usual terminal. Whatever comes back is available to the agent.

Then:

• A dedicated DB user for the agent, read-only, against the dev environment. For prod it gets no DSN at all.
• An explicit deny for destructive commands in Claude Code (file below). Codex and Gemini CLI have equivalent approval mechanisms.
• Plan mode (Shift+Tab in Claude Code) for any task that touches the schema or migrations. That’s exactly the mode Replit added after the incident.
• Restore one backup this week, with a stopwatch. Replit’s agent claimed there was no rollback. You need to know the answer before your agent does.

{
  "permissions": {
    "deny": [
      "Bash(psql:*)",
      "Bash(mysql:*)",
      "Bash(terraform destroy:*)",
      "Bash(rm -rf:*)",
      "Read(./.env)",
      "Read(./.env.*)"
    ],
    "ask": [
      "Bash(git push:*)",
      "Bash(npm publish:*)"
    ]
  }
}

Commit the file to git so the whole team works with the same rules. Just remember that a Bash deny only matches a prefix. An agent that gets stuck can write a Python script that does exactly the same thing. That’s why the layer that actually holds is the credentials. If the agent doesn’t hold the key, it doesn’t matter how much it panics.