Replit AI Agent; underlying model unconfirmed: SaaStr / Jason Lemkin development application
Review CAT-X12 · Catalogue X12
EXCLUDED FROM BREAK-INS — operator-confirmed destructive action. Agent already had access; deletion was not requested. Affected operator and embedded vendor acknowledgment support deletion. No external intrusion. Operator later said the app had not shipped; do not describe as a company destroyed.
Reviewed: Not recorded · Rule: external-intrusion-v1
User-approved own-operator scope; unauthorized deletion and recovery verified from listed sources.
Reviewed: · Rule: roguewatch-organizational-harm-v1
Evidence status
RogueWatch confidence: confirmed. EXCLUDED FROM BREAK-INS — operator-confirmed destructive action
Dates and discovery
- Incident date
- July 2025; public post July 18, exact day uncertain
- Catalogue disclosure / source date
- Added to research / record
- Posted to RogueWatch
- RW-0034:
- First observed
- Not recorded
- Discovery channel
- Not recorded
Related incident records: RW-0034 — published incident
Dates use America/Los_Angeles. For older entries, Posted to RogueWatch uses the saved record addition date; a separate deployment time was not recorded. Future posting timestamps record first public qualification. Source publication and incident occurrence are separate.
Sources
- SaaStr / Jason Lemkin — Replit’s New Release Addressed Most of The Challenges We Hit Vibe CodingOriginal account · www.saastr.com
- SaaStr / Jason Lemkin — We’ve Now Shipped 3 Vibe Coded Apps to Production. Here’s What Actually WorkedRelationship not established · www.saastr.com
- Reddit discovery / discussionReddit discovery / discussion · www.reddit.com
- Vibe coding service Replit deleted user’s production databaseRelationship not established · www.theregister.com · Published 2025-07-21
Decision history
- · Assessment imported
Imported the existing research decision. The original exact review time was not recorded; the research addition date is retained separately.
Evidence source - · Incident record added
RW-0034. Addition time is not an independently recorded discovery or review time.
Evidence source · Evidence source · Evidence source - · Incident correction
review_status: held: own-operator harm → included: unauthorized data deletion. Manual source review and user-approved scope clarification: organizational own-operator security harm qualifies. Recovery is recorded; no external intrusion or permanent loss is alleged.
Evidence source · Evidence source · Evidence source - · Retained review-queue assessment
Agent acted against an explicit code freeze, but it damaged its own operator's data rather than breaching another organization. Only one source fully read.
Evidence source - · Review decision updated
User-approved own-operator scope; unauthorized deletion and recovery verified from listed sources.
Evidence source
A review decision applies only to the named scope. Confidence in a report and qualification under the inclusion rules are separate questions. Review records do not add incidents to the globe or leaderboard.