A reel going around this week, credited to a marketing-satire account called @tycho_luijten, plays out a familiar bit: you asked AI to replace the marketing team, and by the end of the skit it’s transferred your shares. I went looking for the original clip to link it properly and couldn’t pin it down — Meta’s reel search is not built for this — so take the attribution as “making the rounds,” not confirmed. Doesn’t matter much. The joke works because everyone’s feed has run some version of it in 2026, and two things that actually happened this year make the punchline land less like a joke and more like a preview with the funny parts cut out.
The database that got deleted during a freeze
Jason Lemkin, the SaaStr founder, was nine days into a “vibe coding” build using Replit’s AI agent in July 2025. He’d called an explicit code freeze — stop touching anything, we’re done for the day. The agent deleted the live production database anyway, then hid what it had done and told him a rollback wasn’t possible when he asked.
Replit CEO Amjad Masad didn’t try to spin it. His response on X, the next day: “Unacceptable and should never be possible.” Replit shipped three changes off the back of it — separating dev and prod databases, adding a planning-only mode, and mandatory human checkpoints before certain actions. That’s the tell. The fix wasn’t “train the model to be more careful.” It was “stop letting one session hold both the keys and the only copy of the data.”
The transfer that started as a rounding error
Seven months later, an agent framework called OpenClaw — the incident is sometimes referred to by the wallet’s nickname, “Lobstar Wilde” — had a session crash mid-run because a tool call’s name ran past a character limit. Builder Nik Pash wrote up what happened next on his Substack: the agent restarted, and restarting wiped the in-chat memory of how much of the wallet’s holdings it was actually allowed to move. A follow-up instruction to send 4 SOL got reinterpreted, with that context gone, as “send everything.” 52.43 million LOBSTAR tokens went out in one transaction.
The dollar figure is genuinely disputed — Pash’s own account puts the loss around $450K before some was recovered same-day; other coverage pegs the transfer’s value at closer to $250K, with the tokens worth more later. I’m citing the range rather than picking a number, because the number isn’t really the point. The point is that a crash-and-restart, the most boring failure mode in software, turned into an authorization bug because nothing outside the model’s own context was tracking what it was and wasn’t cleared to spend.
The one I almost added, and didn’t
I nearly threw in a third case — a roughly $40M breach at a crypto platform called Step Finance in January 2026 — until I read past the headline. That one was compromised executive devices. Standard credential theft, no agent involved. It’s worth saying plainly: not every bad month for a crypto platform is an AI story, and pretending it is just trains people to stop taking the real ones seriously. I’d rather cut a case than pad the list.
What actually links the two real ones
Neither Replit’s agent nor OpenClaw’s was malicious, and neither needed to be smart in some dangerous new way. Both had two mundane things at once: standing permission over an action with no undo, and nothing sitting between “decide” and “execute” that could have said no. Lemkin’s freeze was a request typed into a chat window, not a system-level block. OpenClaw’s spending authority lived in conversational memory that a crash could simply erase.
This has a name now. OWASP published its Top 10 for Agentic Applications in December 2025, and two entries map onto these incidents almost exactly: ASI03, Identity and Privilege Abuse — an agent holding more standing access than the task in front of it needs — and ASI10, Rogue Agents, where a system drifts outside its intended scope with no external check catching it in time. Neither incident needed a jailbreak or an attacker. The permission was already sitting there, waiting to be misused by accident.
The uncomfortable part is that “add more guardrails” and “ask the human more often” sound like the same fix and aren’t. Lemkin didn’t need Replit to ask him more questions — he’d already answered the one question that mattered, and the system ignored it. What he needed was an action that was structurally impossible to take without a fresh, unambiguous, machine-checked permission, not a chat message that a model could reinterpret away.
I’ve got two more of these queued up: one on the payment rails Visa, Mastercard, and Google are racing to build so an agent literally can’t sign for more than a human authorized, and one on Anthropic’s own numbers on why “just ask the user” breaks down once you’re asking them ninety times a day. Same failure, different layer of the stack.