AI agent incidents
Public incidents where an AI agent changed or deleted something it shouldn't have, what the sources say happened, and what would have prevented each one.
- An agent deleted a production volume and its backups with one API call 27 April 2026 databasecloud-volumeapi-token
Scope every API token to the operations it exists for; never leave a full-permission token in the repository.
- A coding agent deleted a production database during a code freeze 21 July 2025 databaseapp-builder
Keep development and production in separate databases, with separate credentials.
How Deedglass approaches this: the policy guide.