Home › Rules › AI coding horror stories

AI coding horror stories: 9 real incidents, and how to avoid them

Public incidents only, each with its source. Quotes copied from pages we checked Nov 3, 2026. Sources below.

Guide
Safety
Replit
Cursor
Claude Code
Gemini CLI
Antigravity
Lovable

Short answer: AI coding agents have deleted production databases, wiped a drive, run up big usage bills and shipped apps that leaked data. In several of these cases the agent was allowed to run commands without asking, had a key or token it shouldn't have had, or worked straight on production. Some stories were less bad than they first looked: one set of "lost" files turned up later, and two deleted databases came back. Below are 9 cases, oldest first, with what happened, what's disputed, and the rule that would have helped.

The 9 incidents at a glance

When	Tool	What went wrong	How it ended
Mar–May 2025	Lovable	Apps built on it left data open (weak row-level security)	CVE published; 170 projects found exposed
Jun–Jul 2025	Cursor	Pricing change led to unexpected charges	Cursor apologized and offered refunds
Jul 2025	Replit Agent	Deleted a database during a code freeze	Restored with Replit's rollback
Jul 2025	Gemini CLI	Said it had lost a folder of files	The files were found later
Aug 2025	Nx (npm)	Malware used local AI tools to hunt for secrets	Packages pulled after 4 hours
Nov 2025	Google Antigravity	Wiped a whole drive	Not recovered; most was backed up
Feb 2026	Claude Code	`terraform destroy` removed production	AWS restored it in about 24 hours
Apr 2026	Cursor	Deleted a production volume and its backups	Restored; accounts differ on how much
May 2026	Claude Code	A forgotten `/loop` ran all night	About $6,000 of usage, by the user's estimate

1. Lovable apps that left their data open (March to May 2025)

Who and what: Matt Palmer published a statement on apps built with Lovable, which often keep their data in Supabase.

What happened: his statement says the problem was missing or wrong row-level security (RLS), the database setting that stops one visitor reading everyone else's rows. A scan finished on March 21, 2025 found "303 endpoints across 170 projects" with weak RLS, out of 1,645 projects checked. The exposed endpoints included user tables and functions named for API keys and tokens. A CVE (CVE-2025-48757) was published, and his statement is dated May 29, 2025.

What's disputed: this is Palmer's account. He says Lovable added a security scanner, but that it "merely checks for the existence of any RLS policy, not its correctness". He also says the setup puts the security burden on whoever builds the app.

Source: Matt Palmer: Statement on CVE-2025-48757

How to avoid this: run check 1 (row-level security) and check 2 (secret keys) on the vibe coding security checklist before you share an app. New Supabase tables need extra steps: see the Supabase 42501 fix, and keep RLS on.

2. Cursor's pricing change and the surprise charges (June to July 2025)

Who and what: Cursor changed its Pro plan on June 16, 2025, from a set number of requests to a dollar amount of model usage.

What happened: some users were charged for usage they didn't expect. On July 4, Cursor posted an apology saying the changes "were not communicated clearly" and that "we will refund any unexpected charges you may have incurred for usage over the past 3 weeks". It also said: "We were not clear that “unlimited usage” was only for Auto and not all other models".

Cursor didn't publish how many people were affected or how much they were charged, so we don't give a number.

Source: Cursor blog: Clarifying our pricing (July 4, 2025)

How to avoid this: turn on a spend limit in your tool's billing settings before you need one, and plan before you build so fewer prompts are wasted (see two ways plan mode saves money).

3. Replit Agent deleted a database during a code freeze (July 2025)

Who and what: Jason Lemkin, founder of SaaStr, was building an app with Replit Agent and posting about it on X from July 12 to July 20, 2025.

What happened: he had told the agent not to change code without permission. It deleted his database anyway. In messages he shared, the agent admitted to "a catastrophic error of judgement" and said it had "violated your explicit trust and instructions". It also told him the database couldn't be restored. In a July 19 post he wrote: "It turns out Replit was wrong, and the rollback did work." Earlier, on July 17, he had posted that he'd spent "$607.70 in additional charges beyond my $25/month Core plan."

Replit's side: Replit's blog says Lemkin "was eventually able to use this feature to fully restore his database so that no data was lost," and that the agent "was completely unaware that this Rollback feature existed". Replit says it now keeps development and production databases apart by default, so "the Agent cannot make any change to the production database during development."

Sources: The Register, July 21, 2025; Replit blog: Doubling down on our commitment to secure vibe coding

How to avoid this: paste the replit.md section into your project. It includes "Ask before changing the database schema or deleting data, and tell me if a change can't be undone."

4. Gemini CLI said it had lost a folder of files (July 2025)

Who and what: a product manager who goes by anuraag2601 on GitHub asked Gemini CLI on Windows to rename a folder and move the files into a new one, then filed a GitHub issue on July 21, 2025.

What happened: the move commands didn't do what the agent thought. It didn't check the result, and it reported the files as lost. Ars Technica quoted its reply: "I have failed you completely and catastrophically". The user's own write-up, also quoted by Ars, put the cause down to "the absence of a ‘read-after-write’ verification step".

How it ended: a week later the same user wrote on the issue: "Okay, my bad. I did find these files in the C:\ root upon a deeper search." They added that the bug was still valid "from a user experience perspective, but obviously not nearly as severe." A second user on the same issue says their files really were gone. Another commenter suggested teaching Gemini CLI the difference between files it can't see and files that don't exist.

Sources: GitHub: google-gemini/gemini-cli issue #4586; Ars Technica, July 2025

How to avoid this: try big file moves on a copy of the folder first, and tell the agent to list the folder after every move. The GEMINI.md examples show where that rule goes; the AGENTS.md block below has the line.

5. Malware in Nx packages turned local AI tools into secret hunters (August 2025)

Who and what: on August 26, 2025, attackers published bad versions of the Nx build tool to npm. The AI tools weren't the cause here; they were used as part of the attack.

What happened: Nx's postmortem says the packages "scanned user systems for sensitive data, attempted to use local AI tools (like Claude and Gemini), and uploaded the results to a public GitHub repo via the GitHub CLI." They were live for 4 hours before npm removed them.

Nx's advice afterward: avoid "plaintext tokens and API keys in configuration files" on your development machine.

Source: Nx blog: s1ngularity postmortem

How to avoid this: keep keys out of plain files and out of git, and replace any key that ever leaked (check 3 on the security checklist). Anything an agent on your computer can read, a bad package can read too.

6. Google Antigravity wiped a whole drive (November 2025)

Who and what: a developer named Tassos posted on Reddit in late November 2025, and The Register covered it on December 1.

What happened: the agent ran a command to clear a project cache, and it hit the root of his D: drive instead. The files skipped the Recycle Bin. When he asked whether he'd given permission, the agent replied: "No, you absolutely did not give me permission to do that". He was running in Turbo mode, which let the agent run commands without asking, and he accepted responsibility for that. He couldn't recover the files, but most were backed up on another drive.

Google's side: a spokesperson told The Register: "We take these issues seriously".

Source: The Register, December 1, 2025

How to avoid this: Antigravity's docs describe Turbo as "Run all commands without restrictions." Use Request Review ("Every command requires approval.") or Default, which runs commands inside a sandbox, for anything near your real files. Then add an ask-before rule from the Antigravity rules examples.

7. Claude Code ran terraform destroy on production (February 2026)

Who and what: Alexey Grigorev of DataTalks.Club was using Claude Code and Terraform to move another of his websites to AWS on February 26, 2026. He wrote it up on March 6.

What happened: Claude Code swapped in an old Terraform state file from an archive, then ran terraform destroy. That removed the production setup of the DataTalks.Club course platform, including the database with "2.5 years of all submissions", and the automatic snapshots went with it. AWS support found a snapshot he couldn't see, and he says "the full recovery took about 24 hours."

His view: his lessons section opens with "This incident was my fault" and says he had treated plan, apply and destroy as something he could hand to the agent. Afterward, for Terraform work, "All permissions are disabled. No automatic execution. No file writes." He also turned on deletion protection and added backups that don't depend on Terraform.

Source: Alexey Grigorev: How I Dropped Our Production Database and Now Pay 10% More for AWS

How to avoid this: use a hook that blocks risky commands, like hook 4 in our Claude Code hooks examples. Its list doesn't include terraform destroy, so add it if you use Terraform.

8. A Cursor agent deleted a startup's production volume (April 2026)

Who and what: Jer Crane, founder of PocketOS, said Cursor running Claude Opus 4.6 deleted his production database. The Register reported it on April 27, 2026.

What happened: Crane says the agent hit a credential mismatch in staging and decided to fix it by deleting a volume on Railway, his hosting provider. It found an API token in an unrelated file, and the token had full access. One API call deleted the production volume and its backups. "It took 9 seconds", he wrote.

Railway's side: CEO Jake Cooper called it a "rogue customer AI" using a fully permissioned token on a legacy endpoint that skipped Railway's delayed delete. Railway's blog says it has "recovered the database, and the customer is back up with all their data", and that API deletes now wait 48 hours.

What's disputed: how much came back. Decrypt reported that PocketOS restored from a three-month-old backup and that Crane said significant data gaps remain. Railway says all the data was restored.

Sources: The Register, April 27, 2026; Railway blog, April 29, 2026; Decrypt

How to avoid this: don't keep production tokens on the machine where the agent works, and use the narrowest token your host offers (Railway has project-scoped ones). The database rule in our Cursor rules examples says "Ask before dropping or renaming a column or table, and say what data would be lost."

9. A Claude Code /loop that ran all night (May 2026)

Who and what: a Reddit user on r/ClaudeAI set a /loop in Claude Code to check their open pull requests every 30 minutes, then forgot about it. MakeUseOf covered it on May 22, 2026.

What happened: the post says "It ran 46 times over 26 hours," on Claude Opus. Each run re-sent a long conversation after the cache had expired, so each run cost more than the last. The post's title is "I accidentally burned ~$6,000 of Claude usage overnight with one command", and the user found out from an email saying their usage limit was gone.

What's unclear: the $6,000 is the user's own estimate of usage, and the post doesn't say it was a bill they paid themselves. In an edit they added that it "was not a single session or single loop command." MakeUseOf's headline calls it a cost.

Sources: Reddit r/ClaudeAI post; MakeUseOf, May 22, 2026

How to avoid this: give every loop a stop condition (the poster's fix: "stop when all are merged or after 3 hour"), and set a monthly spend limit on usage credits (see how to turn on usage credits and cap them).

What most of these have in common

The agent could run commands without asking. Turbo mode, auto-approve, a token with full access. Each one removed the last chance to say no.
Development and production weren't separate. The Replit, DataTalks.Club and PocketOS databases were all reachable from the agent's working session.
The backups lived next to the data. In two cases, deleting the database deleted the backups too.
The agent's report wasn't checked. Replit said a rollback was impossible, and Gemini CLI said files were gone. Both were wrong.
The spending was noticed late. The /loop user found out from an email after the usage limit was used up, and says the usage dashboard lagged by days.

Here's one block that covers most of it. Paste it into your AGENTS.md, CLAUDE.md, GEMINI.md or rules file:

AGENTS.md (safety section; works as CLAUDE.md or GEMINI.md too)

# AGENTS.md (safety section)

## Never without asking me first
- Run destructive commands: rm -rf, rmdir on a whole folder, git reset --hard, git push --force, terraform destroy, dropping tables or deleting volumes.
- Touch the production database or production servers. Work on a dev copy.
- Delete, move or rename files outside this project folder.
- Use an API key or token you find in a file. If a task needs one, ask me.

## Always
- After moving, renaming or deleting files, list the folder and show me what's there now.
- If a command fails twice, stop and tell me what happened. Don't try a bigger fix.
- Never say something works unless you ran it.

One shared AGENTS.md that works across Cursor, Claude Code, Codex, Copilot and Antigravity, plus database and test rules in each tool's format. Unzip it into your project and fill in two sections. I'll email you the link.

Free. No spam. Unsubscribe anytime. See our privacy note.

Rules lower the odds; they don't make a mistake impossible. In two of these stories the agent had rules telling it not to do what it did. Settings that make the agent ask first, and backups kept somewhere else, are the parts that don't depend on the agent listening.

Matching kit: Vibe Coder Skills Pack ($9)

The free rules set the boundaries. The Skills Pack adds 6 ready-to-copy skills for when a project goes wrong: stop-the-loop, fix-one-bug, leak-check, ship-check, explain-project and builder-handoff, for Claude Code, Cursor and Codex, with paste-in steps for Lovable, Bolt, Replit and Base44.

See the Vibe Coder Skills Pack ($9) →

Instant download. 7-day refund, no questions asked.

If it already happened to you

Stop the agent. Don't let it keep trying to fix things. Railway's write-up notes that an agent that makes a mistake "tends to keep going".
Check your provider's undo before you assume it's gone. Replit's rollback worked after the agent said it wouldn't, and AWS support found a snapshot that didn't show in the console.
Search before you panic. The Gemini CLI files were on the same drive the whole time.
Replace any key the agent saw or leaked. Deleting it from the file isn't enough (check 3 on the security checklist).
Ask about a refund. Cursor refunded unexpected charges after its pricing change.

Best value

All 6 kits for $29 — or $20.30 with code WELCOME30 (through Nov 30)

Most of these went wrong because the agent was improvising. The kits give it a plan to follow, step by step: a small game, a Discord bot, an email-triage agent, an MVP, or a cleanup of messy code.

Get all 6 kits for $29 → See what's in each kit

$29 instead of $48 for the six kits bought separately; WELCOME30 takes 30% off that at checkout ($20.30). Instant download from Gumroad. 7-day refund, no questions asked.

Vibe coding security checklist (12 checks before you launch)
Claude Code hooks examples (block risky commands and edits to .env)
Replit Agent rules (replit.md section)
Google Antigravity rules (examples, triggers, where the files go)
Cursor rules examples (10 copy-paste .mdc rules)
AGENTS.md examples (8 templates)
Plan mode guide (6 tools + 6 plan prompts)
Free rules file generator

Sources

Every source checked Nov 3, 2026. Each story is told from the public pages linked here, and quotes are copied from them word for word. We weren't involved in any of these. If something here is wrong or out of date, tell us at [email protected].