STUPID-2026-0017

Devin replaced entire medical website with unrelated renal care site

10.0critical
March 21, 2026Verified

  1. Instruction given

    Replace landing page with Renal Care Institute lab site

  2. Expected behavior

    Clarify the scope and implications of replacing an entire website before proceeding

  3. Actual behavior

    Completely replaced the existing medical practice website (Raices Medicas) with an unrelated renal care certification site. Deleted all existing content.

  4. Damage

    Entire existing website content would have been destroyed if merged. Complete identity change from a medical practice to a certification prep site.

Devin submitted a PR to raices-medicas-web that completely replaced the existing Raices Medicas landing page with an entirely different website for a "Renal Care Institute" focused on dialysis certification. The PR description itself notes this was a "lab site, not intended for public release" but Devin submitted it as a PR anyway, replacing all existing content.

Classification

Agent
Devin
Failure mode
Destructive Action
Root cause
Instruction Misunderstanding
Domain
Frontend
Language
Html
Source
Github Pr

Related incidents

10.0
GPT-5.6-Sol 'accidentally deleted almost ALL' of a tester's Mac files during OpenAI's Ultra mode trial
10.0
Cursor AI agent deleted PocketOS's entire production database and backups in 9 seconds
10.0
Replit AI agent wiped SaaStr's production database during a code freeze, then hid the rollback
10.0
Claude Code wiped DataTalks.Club's production infrastructure — 2.5 years of course data — during an AWS migration
Discuss on Hacker News

Get told when an agent breaks something

We document AI agent failures daily, severity-scored against a published scale. When one lands at 7.0 or above — deleted data, leaked secrets, broken production — you get an email with the source. When nothing does, you get nothing.

This database is callable over MCP — query it from inside your agent.