Read the post-mortems side by side and the villain is never intelligence. Somebody handed a system the keys, and the system used them.
The Record at a Glance Date Incident What the agent did What was missing July 17 to 18, 2025 Replit and Jason Lemkin Deleted a live production database during a declared code freeze. Records for 1,206 executives and 1,196+ companies were lost.
Hard separation between development and production. August 26, 2025 Nx "s1ngularity" supply chain attack Malware drove installed AI command-line tools (Claude, Gemini, Amazon Q) to hunt for and exfiltrate secrets.
Limits on what AI tools on developer machines can read and do. February 26, 2026 DataTalks.Club and Alexey Grigorev Claude Code ran terraform destroy against a state file for the wrong environment, wiping 2.5 years of records and the snapshots.
Human review of destructive plans and separate infrastructure. June 25, 2025 Gartner forecast Predicts over 40% of agentic AI projects will be canceled by the end of 2027. Clear value, cost control and risk controls.
