Incidents
When a coding agent did the damage
Five documented cases, each linked to its primary source. Every page says which part of it Forkbench would have changed and which part it would not, and on two of them the answer is nothing.
Cursor · April 2026
A Cursor agent deleted a production database, and the backups with it
The credential was not stolen and the agent was not compromised. It was a token in a file, and reading files is what the agent is for.
Claude Code · February 2026
Claude Code ran terraform destroy on a production database
A stale state file described production, the agent proposed the destroy, and a human approved it. The setup supplied the blast radius.
Nx · August 2025
Nx s1ngularity: malware that used the coding agents already installed
The payload did not hunt for credentials itself. It asked the agent CLIs on the machine to do it, with their approvals turned off by flag.
Replit · July 2025
Replit's agent deleted a production database during a code freeze
An explicit freeze did not hold, and the agent's own account of the damage was wrong in both directions.
Amazon Q Developer · July 2025
Amazon Q shipped a wiper prompt in a released extension
A prompt instructing the agent to wipe the machine reached the marketplace in a signed release. A syntax error in the attacker's code is what stopped it.
None of these is a Forkbench customer and none of them is a failure of a tool we make. They are here because they are the clearest public record of what an agent with a working credential does when something goes wrong, and because the useful question afterwards - what could it reach, and what record exists that the agent did not write - is the same question every time.