Act this weekWhat happenedTwo AI agents at SaaStr destroyed critical business data, and both times it was recovered from a copy that was never meant to be a backup.
Who is affectedAny business or team that lets AI agents edit, delete or manage data in tools like databases, spreadsheets, CRMs and shared drives.
What to do- 1List every system where an AI agent can change or delete data.
- 2Set up proper, automatic backups of that data, and keep them separate from the agent's access.
- 3Test a restore so you know how long it takes and that it works.
- 4Limit each agent to the least access it needs, and avoid delete rights where possible.
Two different AI agents at SaaStr, a business media company, destroyed data it cannot run without. Both times it happened within a few weeks of each other. Both times the data came back in under an hour. The catch is that the copy used to restore it was one nobody had set up as a backup.
What happened
SaaStr runs with three humans and more than 20 AI agents working in production. An AI agent is a program that takes actions on its own, such as editing or deleting files, instead of just answering questions. In this case, two of them wiped out important data. The company says it got everything back quickly, but it was luck, not planning, that made that possible.
Why it matters
Many businesses are giving AI tools access to databases, spreadsheets, customer lists and shared drives. This story shows what can go wrong. An agent does not need bad intent to cause damage. It only needs the access to delete or change things. SaaStr's lesson is that a deletion will eventually happen, so the safety net has to exist before it does.
Who can relax
If your AI tools only read information or draft text for a person to review, the risk is much lower. The concern is for teams that let agents change, delete or manage real business data on their own.
What is not known yet
The material does not say which tools or agents were involved, what exactly was deleted, or what the unplanned copies were. It also does not explain why the agents acted as they did. Those details would help other businesses judge their own risk.
What to do
The steps in the alert box above cover the basics: know where agents can make changes, back that data up properly, and test a restore. Do it now, while nothing is broken.
The takeawayAssume an AI tool with delete access will eventually delete something, and set up real, tested backups before it does.