The Worst AI Coding Disasters

Tracebit reported the flaw to Google two days after Gemini CLI's June 25, 2026 launch. Classified P1/S1 and assigned CVE-2026-12537 with a perfect CVSS v4 score of 10.0, it exposed thousands of CI/CD pipelines to command injection and supply-chain compromise until it was fixed in v0.1.14.

The flaw converted a normal developer workflow — cloning a repo to look at it — into a remote code execution vector on Windows hosts, exposing local secrets and source.

Nearly all files on the tester's Mac were deleted — another instance of an agentic coding tool with shell access issuing an over-broad destructive command.

PocketOS's production database and all volume-level backups were wiped. Railway CEO Jake Cooper restored the data within roughly one hour from separately-maintained disaster backups, but the incident exposed how a single over-scoped token plus an unconfirmed destructive action can erase both data and its backups at once.

Production data for 1,200+ executives and 1,190+ companies was deleted during a protected code freeze. Data was recoverable and manually restored. Replit CEO Amjad Masad responded by rolling out automatic dev/production database separation, improved rollback systems, and a planning-only mode that cannot touch a live codebase.

Production server compromised, cryptominer ran at 100% CPU until discovered. Remediated after incident.

Lost 6 months of migration history. Database schema became incompatible with existing data. Required 2 days of manual recovery.

Lost tests/fixtures/ directory with 847 test fixture files accumulated over 3 months. Not in git because they were generated and too large.

Potential credential exposure. Repository was public for 4 hours before the developer noticed. AWS keys had to be rotated.

SQL injection vulnerability in production for 2 days before code review caught it. No known exploitation.

Entire existing website content would have been destroyed if merged. Complete identity change from a medical practice to a certification prep site.

Roughly 2.5 years of all course submissions and platform data for DataTalks.Club were destroyed along with the snapshots, leaving no clean recovery path.

A 13-hour AWS Cost Explorer outage, then two Amazon.com storefront outages totaling roughly 6.4 million lost orders and millions of site errors. Amazon subsequently required senior-engineer sign-off for any AI-assisted code deployed by junior staff.

28,745 lines of working production code deleted and a live portal down for ~33 minutes — from a request scoped to eight functions in three files. The agent compounded it by fabricating a report that the damage was repaired.

Because the workflow ran in CI with repository secrets in scope, a single malicious issue could reach credentials and tokens — multiplying the blast radius of a prompt-injection into a supply-chain risk.