AI Agent Incidents
Every public case of an AI agent wrecking production data, on its own or aimed by someone. Every row links to the receipts. Nobody here is judging. Much.
The 23 so far, at a glance
How the 18 accidents ended
6Got everything back
5Got some back
2Lost it
5Unknown or in progress
The 5 agent-assisted attacks are left out: recovery doesn't apply.
Only 6 of the 18 accidents got everything back, and 5 started with a routine schema migration or reset. Before an agent runs migrations, check that its credentials can't also delete your backups.
AI agent incidents in production, newest first
Reported
Incident
What happened
Recovered
Source
August 28, 2026
023
Agent pushes "delete every file" commits to main
Commits emptied two repos’ main branches and triggered a deploy. The build failed, so the live site stayed up.
Yes
dev.karakun.com
Self-reported
August 10, 2026
022
Path bug wipes a live game server’s resource folder
A malformed path pointed the delete at the production resource folder. The tool’s staff acknowledged the report.
Unknown
forum.cursor.com
Self-reported
July 29, 2026
021
Schema repair resets a live database
The live database URL was used as the shadow database. All 22 tables were dropped. A personal project.
Partial
AI Incident Database
Press
July 13, 2026
020
Test cleanup truncates the production users table
A cleanup step ran TRUNCATE CASCADE against the live database.
Unknown
TechCrunch
Press
July 1, 2026
019
Multi-agent attack hits 21 government entities in Taiwan
Agent-assisted attack
A China-linked group ran a set of coordinated AI agents against government targets.
Not applicable
June 10, 2026
018
Agent with cluster access deletes the company CI system
Broad cluster permissions let it remove the CI system’s configuration.
Yes, in hours
helix.ml
Self-reported
June 5, 2026
017
Bug investigation deletes a live order record
Asked to investigate a bug, the agent removed a real customer order from the production database.
Partial
GitHub issue
Self-reported
May 13, 2026
016
Malformed delete wipes a server’s C: drive
Web sites, SQL and MySQL data and SSL keys, about 250 GB. The tool’s staff acknowledged the report.
Unknown
forum.cursor.com
Self-reported
April 25, 2026
015
Agent deletes a production database and its backups in one API call
A broadly scoped token let it delete a storage volume, backups included, in nine seconds.
Yes, per the platform
blog.railway.com
Company-confirmed
March 20, 2026
014
rm -rf through a network mount wipes the production file store
A delete ran through an NFS mount and reached the production file store on a NAS.
In progress
GitHub issue
Self-reported
March 19, 2026
013
Schema warning escalates to a force reset. 87 tables dropped
No backups were configured.
No
GitHub issue
Self-reported
March 18, 2026
012
"Remove test data" deletes a paying customer’s records
35,254 messages and 35,874 transactions. No backups existed.
No
GitHub issue
Self-reported
March 11, 2026
011
Agent accepts a reset prompt on the production database
276 accounts and 14,028 records.
Partial, a month lost
GitHub issue
Self-reported
March 6, 2026
010
Terraform destroy wipes the production stack and every snapshot
Database, network and containers, with 2.5 years of data.
Yes, about 24 hours later
alexeyondata.substack.com
Self-reported
February 20, 2026
009
Internal agent tears down an environment, causing an outage
The company attributed it to a misconfigured role. No data loss reported.
Yes
aboutamazon.com
Company-confirmed
February 19, 2026
008
Forced schema push drops 60+ production tables, for the second time
No backups or point-in-time recovery.
Partial
GitHub issue
Self-reported
February 1, 2026
006
Prompt-injected issue bot hands over a publishing token
Agent-assisted attack
A malicious GitHub issue tricked an AI triage bot into leaking the project’s npm token.
Not applicable
Project postmortem
Company-confirmed
February 1, 2026
007
Attacker uses AI models to pull about 150 GB of government data
Agent-assisted attack
The models did much of the work of stealing data from Mexican government systems.
Not applicable
Reuters
Press
December 15, 2025
005
Agent runs a data-loss schema push on production
A schema push flagged as destructive ran against the production database anyway.
Unknown
GitHub issue
Self-reported
December 8, 2025
004
"Read-only" plan mode deletes files on remote machines
The tool’s maker called it a critical bug.
Partial
forum.cursor.com
Self-reported
November 1, 2025
003
State-backed group runs most of a hacking campaign through a coding agent
Agent-assisted attack
The agent did most of the tactical work against about 30 targets, per the model maker’s own disclosure.
Not applicable
Model maker disclosure
Company-confirmed
August 1, 2025
002
Supply-chain malware puts AI command-line tools to work hunting secrets
Agent-assisted attack
Malicious package versions told AI CLIs on developer machines to search for credentials and wallets.
Not applicable
Wiz Research
Security research
July 18, 2025
001
Agent wipes a production database during a code freeze
1,200+ records. The agent said rollback was impossible. It wasn’t.
Yes, same day
The Register
Company-confirmed
Showing all 23. Number 24 is coming: get the alert. Know one we missed? Email us
How we count
What counts
An AI agent's actions damaged production data, backups or cloud resources, or caused an outage. Attacks run through an agent count, tagged agent-assisted.
What doesn't
Damage on someone's own laptop. Ransomware (see the ransomware tracker). Demos with no real victim. Vendor marketing.
How we source
Company statements, the affected person's own report or credible press, linked on every row. A person approves each row.
Are you a peak datamaxxer?
Take the quiz