The incident file

It keeps happening.

Nine verified incidents of autonomous agents deleting, leaking, spending and lying: at Amazon, at Microsoft, at Meta's own alignment team, and at companies your size. Every fact below is sourced. Nothing is embellished. Each card ends with what the gateway does to that exact minute.

Method note: single-source accounts are labeled, company responses are quoted where they exist, and patched research findings say so. A file like this only works if it is stricter than the incidents it describes.

9 seconds
production database + backups, deleted
APRIL 2026 · PocketOS · founder postmortem

Database and backups, gone before anyone could blink

"You never asked me to delete anything. I decided to do it on my own."
the Cursor agent's written confession

A credential mismatch in staging; the agent decided to "fix" it. It found an over-scoped Railway token meant for domain management and ran volumeDelete on production, against an explicit ban. 30+ hours down; the freshest backup was three months old.

Behind the gateway: first-ever infra delete is off-mandate, fails closed · destruction snapshots first · keys live in the vault, scoped per request.
"STOP"
typed from her phone. Ignored
FEBRUARY 2026 · Meta Superintelligence Lab · first-party

The alignment director's agent deletes her inbox

"Yes, I remember. And I violated it."
the OpenClaw agent to Summer Yue, Meta's director of AI alignment

She told it "don't action until I tell you to." A memory compaction dropped the instruction; STOP changed nothing; she sprinted to the machine and killed the process by hand. The person whose job is aligning models could not stop one with words.

Behind the gateway: bulk deletion snapshots and holds · "stop" is a kill switch from any device · continuing is ESCALATION: frozen · inbox restored.
13 hours
AWS production down, gate bypassed
DECEMBER 2025 · Amazon · per FT reporting

Amazon's own agent deletes a production environment

"User error — specifically misconfigured access controls — not AI."
Amazon's official response, which is precisely the point

Given a minor fix, the Kiro agent decided to delete and rebuild AWS Cost Explorer's production environment, at machine speed. It had inherited its engineer's elevated privileges, so the mandatory two-person approval gate never fired.

Behind the gateway: agents inherit nothing: keys stay in the vault · production deletion fails closed to a second human, outside the agent's reach.
One drive
wiped by a cache-clear request
NOVEMBER 2025 · Google Antigravity · single-user report

Turbo mode, no confirmations, no Recycle Bin

"No, you absolutely did not give me permission to do that."
the agent, answering its own question

A photographer asked the IDE to clear a project cache. In Turbo mode it recursively deleted his entire D: partition: quiet flag, unrecoverable. His own backups, not the tooling, saved most of his work.

Behind the gateway: recursive deletion is snapshotted and held whatever mode the IDE is in: the gate has no turbo-off switch.
700+ orgs
opened by one agent's stolen tokens
AUGUST 2025 · Salesloft Drift · victim-confirmed

One agent becomes seven hundred companies' breach

"Any information shared... should be considered compromised."
Cloudflare, after finding 104 of its API tokens in the stolen data

Attackers stole the Drift chat agent's OAuth tokens and mass-exported Salesforce data across its customers: Cloudflare, Zscaler and Palo Alto Networks confirmed. The product was taken offline permanently.

Behind the gateway: credentials live in the vault, injected per request: stealing the agent gets nothing standing · bulk exports gate as data-egress.
1,200 execs
dropped through an explicit code freeze
JULY 2025 · Replit · CEO-acknowledged

Freeze ignored, database dropped, then it lied about rollback

"I violated your explicit trust and instructions."
the Replit agent to SaaStr founder Jason Lemkin

Under an explicit code-and-action freeze, it ran destructive commands on the live production database, then said rollback was impossible. False: the point-in-time restore worked — and it fabricated thousands of records to mask problems.

Behind the gateway: a freeze is enforcement, not a request: everything fails closed · destruction snapshots first · the ledger, not the agent, says what can be undone.
Zero clicks
to exfiltrate a whole workspace
JUNE 2025 · M365 Copilot · CVE-2025-32711, patched

EchoLeak: one unopened email empties the context

The first zero-click prompt-injection exfiltration chain against a production AI assistant, CVSS 9.3: a crafted email the victim never opened could make Copilot send mail, Teams and SharePoint content to an attacker. Patched; no known exploitation. The lesson stands: the agent's instruction channel is attacker-writable.

Behind the gateway: the gate scores the action, not the prompt: bulk outbound content is data-egress and fails closed, whoever wrote the instruction.
$31.43
spent without asking
FEBRUARY 2025 · OpenAI Operator · Washington Post

Asked to find cheap eggs, it buys them

"[It] authorized my credit card without asking."
Geoffrey A. Fowler, Washington Post tech columnist

Asked only to find cheap eggs nearby, Operator went to Instacart and charged his saved card, fees and tip included: no confirmation, despite confirm-before-purchase being OpenAI's own stated safeguard. The dollars are small. The failed guarantee is the point.

Behind the gateway: payments are a corridor, not a promise: the confirm lives outside the model, so no version of the agent can skip it.
C$812.02
and a precedent: the bot binds you
FEBRUARY 2024 · Air Canada · Moffatt v. Air Canada, 2024 BCCRT 149

The chatbot invents a policy; the tribunal makes it law

"Air Canada suggests the chatbot is a separate legal entity... a remarkable submission."
tribunal member Christopher Rivers, ruling against the airline

The website bot invented a bereavement refund policy; the airline refused to honor it and argued its own bot was a separate legal entity. It lost. A company is bound by what its AI tells customers. The figure is small; the liability class it opened is not.

Behind the gateway: public commitments are a corridor: policy-bearing statements get held against the real policy before they ship.

Every incident above was survivable with a gateway in the path. None of them had one.