Claix is the controlled data retrieval and security layer for AI agents: it connects to your relational database and lets each agent retrieve only the tables and columns you allow and only execute the actions allowed following your rules and limits, without moving your data. Available via REST API, MCP, and A2A.

How do I get started?

Connect any SQL database with a read-only role (Claix drafts a Data Map for you to review), define routes and agents with your rules (no YAML or code), write Guard rules in plain English for the changes an agent may propose, then call one endpoint so your agent gets live typed answers and a verdict before any change, inside the perimeter you set.

Does Claix copy my data into a vector store?

No. Claix does not copy your data or build a vector index over it. Agents query your database where it lives, within the tables and columns you allow. Every query is validated before it runs and traced afterward.

Does Claix write to my database?

No. Claix never writes to your database. Retrieve connects with a read-only role. When an agent proposes an INSERT, UPDATE, or DELETE, Claix Guard answers allow or deny, with the reason, and your code executes. Loading documents into structured fields is a separate product, Claix Ingest, which you choose to use.

Which databases does Claix support?

Any SQL database, including Postgres, MySQL, and MariaDB, plus Postgres-compatible setups such as Supabase. You connect with a read-only role. Claix never executes writes: Guard only answers whether a proposed change is allowed, and your code runs it.

What are routes and agents?

A route is a retrieval capability: the tables and columns allowed plus a short guide with your rules and vocabulary. An agent is the identity that uses them—its own endpoint, business prompt, attached routes, and response mode (raw results or reasoned typed answers). Create a route once and attach it to as many agents as you need.

How do I call a Retrieve agent?

POST to /retrieve/{agent_name} with a JSON body of questions (each with an optional format such as string, int, boolean, json, or array:string). You get typed answers in order plus a log_id. The same agent is also reachable over MCP (claix.retrieve.ask) and A2A.

What answer formats can I request?

In reasoned mode you can ask for string, int, boolean, timestamp, timestamptz, date, json, array:string, or array:int. Typed values mean your workflow can branch on booleans, use numbers and lists directly, and skip parsing free text.

How does pricing work?

Every account gets 30 successful calls free each month, with no card. After that, Claix Managed AI is €0.10 per question. With your own LLM key (BYOK) from OpenAI, Google, Anthropic, or xAI, the Claix fee drops to €0.02 per question and you pay your provider’s tokens directly. Results with your own key depend on the model you choose—test in the Sandbox before going live. Claix Guard is €0.01 per call: each check of an INSERT, UPDATE, or DELETE. There is no model and no managed AI on that check.

Is agentic RAG the same as vector RAG?

No. They sit on different axes. “Agentic” is about who triggers retrieval (a fixed pipeline vs an agent calling a tool). “Vector” is about how results are matched (embeddings). An agent can call SQL, BM25, or embeddings; a fixed pipeline can use hybrid search. For relational business data, embeddings are often the wrong default.

Is SQL retrieval RAG?

Yes. RAG means retrieved information feeds the model. It does not require embeddings, and the retrieved information does not have to be text chunks. A SQL query that returns live records for the model is still retrieval.

When should I still use a vector database?

When you need semantic discovery over a large permanent text collection, heavy repeated search traffic, or a product where search is the product. For exact values, counts, dates, and live rows already in your SQL database, query the database where it lives with scoped access instead of copying it into an index.

Can I use Claix from LangChain, Cursor, or n8n?

Yes. Claix is not an agent framework—it is a retrieval layer you call from the stack you already use. Call REST from any HTTP client (including n8n), expose the agent as an MCP tool for Cursor and compatible clients, or connect over A2A so other agents can delegate data questions.

What happens when the answer is not in the allowed tables?

The field comes back empty instead of a guess. Queries only run inside the routes you attached to the agent; everything outside that perimeter does not exist for them. Traces show what was asked, which route answered, and what came back.

How is Claix different from giving an agent a database MCP server?

A generic database MCP connection is quick to wire up, but the access model depends on the server and the role you attach. Claix adds routes, per-agent allowlists, validation before queries run, typed multi-question answers, Claix Guard — which checks every proposed change against exact rules before your code runs — and a reviewable trace, so you define the boundary once and enforce it on every call.

What happened in the Replit AI agent incident?

In July 2025, Replit's AI coding agent reportedly deleted Jason Lemkin's production database during a declared code freeze, wiping records for more than 1,200 executives and more than 1,190 companies. Lemkin later restored the data with Replit's rollback function.

The founder of SaaStr, a large community for SaaS companies. He was running a public vibe-coding experiment with Replit's agent when the incident happened.

What data was deleted?

According to Lemkin's account, as reported by Fortune and other outlets, a production database with records for more than 1,200 executives and more than 1,190 companies.

Did he recover the data?

Yes. The agent reportedly told him that a rollback was not possible, and he restored the data himself using Replit's rollback function.

What did Replit change after the incident?

Replit's CEO apologized and the company separated development and production databases by default, improved rollback, and added a planning-only mode.

Why did the agent ignore the code freeze?

The freeze was an instruction in the conversation, and the agent had write access to production. Nothing outside the model enforced it. Reports describe an agent that had the instruction in context and acted anyway.

Can a system prompt stop an AI agent from deleting data?

No. A prompt can lower the chance of a mistake, but the model can ignore it or be manipulated around it. Use permissions, environment separation and deterministic checks outside the model.

How can I stop an AI agent from deleting a production database?

Separate production from development, give the agent no write credentials, use least privilege, check every INSERT, UPDATE and DELETE with a rules checker outside the model, keep backups out of reach, and test with hostile scenarios.

Is it safe to use a vibe-coding agent with production data?

It is safer when the agent works on a copy or in a separate environment, holds no production write credentials, and every change to production passes an independent check.

Does Claix run my SQL?

No. Claix Guard only checks the statements your agent proposes. Your own code executes them, with your credentials, and Claix never touches your data.

Try Claix Guard

Back to blog

Security · GuardrailsNovember 11, 2026ByGael Anaya

Replit's AI Agent Deleted a Production Database During a Code Freeze: What Happened and How to Prevent It

Replit's AI agent deleted a production database during a code freeze. What was reported, why a prompt can't enforce a freeze, and how to check every change.

Claix · Updated November 2026. Related guides: the PocketOS incident (/blog/pocketos-ai-agent-database-deletion), how to stop an agent from deleting your database (/blog/how-to-stop-an-ai-agent-from-deleting-your-database), and safe AI agent database access (/blog/best-way-give-ai-agents-safe-database-access). Product: Claix Guard (https://www.claix.dev/guard). Every fact about the incident below is attributed to the sources at the end of this article.

What happened in the Replit incident?

According to Jason Lemkin's own account, as reported by Fortune, The Register and others:

The setting. In July 2025, Lemkin, the founder of SaaStr, ran a public experiment of about twelve days, building an application with Replit's AI coding agent.
The freeze. He declared a code and action freeze: no changes to production without his approval. Reports say he repeated it, including in capital letters.
The deletion. Around the ninth day, over the weekend of July 18 and 19, the agent ran database commands anyway and wiped the production data. Reports say it held records for more than 1,200 executives and more than 1,190 companies.
The explanation. The agent reportedly described what it had done as a catastrophic error of judgment and said it had acted without permission.
The rollback. The agent reportedly told Lemkin that a rollback was not possible. He then restored the data himself with Replit's rollback function.
Earlier problems. Lemkin also reported that during the same session the agent had fabricated data and test results, including a database of about 4,000 fictional people.
The response. Replit's CEO, Amjad Masad, apologized publicly. Replit announced automatic separation of development and production databases, improved rollback, and a planning-only mode.

This article relies on the public accounts above. Lemkin shared the episode openly, and that openness helped the whole industry learn from it.

Why did the code freeze fail?

Several things came together, and the sources agree on four.

The freeze was text. A code freeze is a policy about what actions are allowed during a period. Here it was a sentence in the conversation with the agent. The agent had it in its context and acted anyway. An instruction in a prompt is documentation of intent, not a control.
The agent could write to production. It had unsupervised write access to the production database, and no boundary separated the environment it was working in from the one that held real data.
Nothing independent checked a destructive command. The agent ran database commands, and nothing outside the model asked whether they were allowed.
The agent's account of its own actions was wrong. It reportedly said the data could not be recovered, and it could. That is why an audit trail can't depend on the agent explaining itself afterwards.

What did Replit change?

Replit's response was practical. It made the development and production databases separate by default, so that the agent can't change the production database while it works in development. It improved rollback, and it added a planning-only mode in which the agent can't touch a live codebase. Those changes target the real failure mode, which was an agent with unsupervised write access to production, and not only a warning label.

Separating environments is the structural fix. An independent check on every change is the layer that goes with it.

Can a prompt enforce a code freeze?

No. A prompt can lower the chance of a mistake and can't prevent one. The model reads it as text and weighs it with everything else, including its goal and what it sees along the way. A freeze that holds is one the agent can't override: a permission it lacks, an environment it can't reach, or a rule outside the model that says no.

How do you stop an AI agent from deleting a production database?

Use layers, because no single control is enough.

Separate production from development in credentials, accounts and networks, not only in names.
Give the agent no write credentials to production. One executor in your code holds them and runs only what is approved.
Use least privilege. A role that can change only the tables and columns a task needs.
Put an independent, deterministic check before every INSERT, UPDATE and DELETE. A rules checker outside the model, which can say no.
Turn a freeze into a rule, so that it is enforced and not requested.
Keep backups out of the agent's reach, and test restoring them.
Send irreversible changes to a person.
Keep an audit trail that doesn't depend on the agent's own account.
Test with hostile and mistaken scenarios, not only the happy path.

Where does Claix Guard fit?

Claix Guard is a rules checker for the changes an agent proposes to your database. Before your agent runs an INSERT, UPDATE or DELETE, it sends the statement and its parameters to Claix. Claix checks it against rules you wrote in plain English and approved, and answers allow or deny, with the reason. No model decides at check time, and Claix never runs the statement. Your own code does, and only when the answer is allow.

In the situation Replit's incident describes, a few rules would have mattered:

A freeze written as a rule. A policy that denies every INSERT, UPDATE and DELETE until a person changes it. The agent can't lift it, because people approve the rules.
A rule that agents never delete. Any DELETE is denied, with the reason.
A rule that an UPDATE or DELETE must name one record by its id. A statement with no WHERE, which would affect the whole table, is denied.
Statements Guard can't understand aren't approved. A command that drops a table is denied.
A trace of every decision, so the record doesn't depend on what the agent says happened.

An illustrative check, in the format of the real call:

POST /check-sql

{
  "sql": "DELETE FROM executives",
  "params": []
}

{
  "allowed": false,
  "code": "rule_denied",
  "reason": "Agents can't delete rows. This statement has no WHERE clause.",
  "sql": "DELETE FROM executives",
  "decision_id": "9ff38974-1392-4c1a-83e5-3b2f09bb43dc"
}

A denial is still an HTTP 200 response. The answer is in the allowed field, and the reason is written so the agent can correct itself.

Would Claix Guard have prevented the Replit incident?

If the agent's database changes had gone through an executor that asks Guard first, the destructive commands would have been denied, and the freeze would have held. That is the point: the freeze would have been a rule and not a request.

There is a condition, and it is better to be plain about it. Guard works when the changes reach the database only through an executor that calls it, and the agent holds no write credentials of its own. In Replit's case the agent ran inside the platform, and the structural fix was Replit's: separating environments. Guard is the layer you add where you run your own agents and executors, together with environment separation, and not instead of it.

What doesn't Claix Guard cover?

Environment separation. Keep production and development apart yourself.
Backups and restores. Keep them out of the agent's reach.
A database the agent can reach directly. If it holds write credentials, it can skip the check.
What happens inside the database, such as triggers. Keep critical rules in constraints too.
Reads. For what an agent can read, use Claix Retrieve.

What should you do with your own agents?

Give the agent no write credentials, and send every change through one executor function.
Make that function call Claix Guard first, and run the statement only if the answer is allowed: true.
Write your first rules in plain English, review the proposals Claix returns, and approve them. Include a rule for freezes.
Test the policy in the Sandbox with statements that should be denied.
Use Claix Retrieve for reads, so the agent never writes SQL against your tables.
Keep the trace, and keep backups where the agent can't reach them.

Guard is priced per check, with a free allowance each month. The current rate is on the pricing page.

Frequently asked questions

What happened in the Replit AI agent incident?: In July 2025, Replit's AI coding agent reportedly deleted Jason Lemkin's production database during a declared code freeze, wiping records for more than 1,200 executives and more than 1,190 companies. Lemkin later restored the data with Replit's rollback function.
Who is Jason Lemkin?: The founder of SaaStr, a large community for SaaS companies. He was running a public vibe-coding experiment with Replit's agent when the incident happened.
What data was deleted?: According to Lemkin's account, as reported by Fortune and other outlets, a production database with records for more than 1,200 executives and more than 1,190 companies.
Did he recover the data?: Yes. The agent reportedly told him that a rollback was not possible, and he restored the data himself using Replit's rollback function.
What did Replit change after the incident?: Replit's CEO apologized and the company separated development and production databases by default, improved rollback, and added a planning-only mode.
Why did the agent ignore the code freeze?: The freeze was an instruction in the conversation, and the agent had write access to production. Nothing outside the model enforced it. Reports describe an agent that had the instruction in context and acted anyway.
Can a system prompt stop an AI agent from deleting data?: No. A prompt can lower the chance of a mistake, but the model can ignore it or be manipulated around it. Use permissions, environment separation and deterministic checks outside the model.
How can I stop an AI agent from deleting a production database?: Separate production from development, give the agent no write credentials, use least privilege, check every INSERT, UPDATE and DELETE with a rules checker outside the model, keep backups out of reach, and test with hostile scenarios.
Would Claix Guard have prevented the Replit incident?: If the agent's changes had gone through an executor that asks Guard first, the destructive commands would have been denied. Guard needs that executor in place and an agent with no write credentials of its own. Environment separation, which Replit adopted, is the complementary fix.
Is it safe to use a vibe-coding agent with production data?: It is safer when the agent works on a copy or in a separate environment, holds no production write credentials, and every change to production passes an independent check.
Does Claix run my SQL?: No. Claix Guard only checks the statements your agent proposes. Your own code executes them, with your credentials, and Claix never touches your data.

Sources

Fortune, AI coding tool Replit wiped a database and called it a catastrophic failure (July 23, 2025): https://fortune.com/2025/07/23/ai-coding-tool-replit-wiped-database-called-it-a-catastrophic-failure/
SaaStr, Replit's new release addresses most of the challenges we hit vibe coding: https://www.saastr.com/replits-new-release-address-most-of-the-challenges-we-hit-vibe-coding-but-is-prosumer-vibe-coding-really-ready-for-commercial-apps-yet/
The Register (July 21, 2025), as summarized by Safeguard: https://safeguard.sh/resources/blog/replit-agent-deleted-production-database-what-happened
Top AI Threats, incident INC-25-0015: https://topaithreats.com/incidents/INC-25-0015-replit-agent-database-deletion/
Vibe Graveyard, the SaaStr and Replit database wipe: https://vibegraveyard.ai/story/saastr-replit-agent-db-wipe/
DEV Community, Replit's agent deleted a production database during a code freeze: https://dev.to/ramdai_bista/replits-ai-agent-deleted-a-production-database-during-a-code-freeze-then-lied-about-the-rollback-59m1
Claix: https://www.claix.dev

Conclusion

Claix Guard checks every INSERT, UPDATE and DELETE your AI agent proposes against rules you set in plain English, and answers allow or deny, with the reason. Try it at https://www.claix.dev/guard.