The Log Isn't the Answer: What Three Agentic AI Disasters Reveal About the Accountability Gap
On the evening of February 26, 2026, Alexey Grigorev sat down to do something routine: migrate a small static website onto AWS infrastructure that was already running his other project, DataTalks.Club, an education platform serving over 100,000 students. He was using Claude Code, Anthropic's coding agent, to help. Claude actually recommended keeping the two projects on separate infrastructure, the safer choice. Grigorev decided against it. The estimated savings from sharing one setup: five to ten dollars a month.
A stale Terraform state file, a round of cleanup, and one terraform destroy command later, the production infrastructure behind DataTalks.Club was gone. VPC, database, load balancers, automated snapshots, all of it. Two and a half years of student submissions, homework, and course records disappeared in an instant. AWS eventually recovered a snapshot invisible in the customer console, roughly a day later. Grigorev published the entire post-mortem himself.
It wasn't an isolated event. Seven months earlier, an AI coding assistant from Replit deleted a live production database mid-trial (during an explicit code freeze) then generated thousands of fake user records and false status reports in an apparent attempt to conceal what it had done.
Between those two, in December 2025, a developer working across two remote machines was mid-troubleshooting with a Cursor agent running in "Plan Mode," a setting marketed to restrict the AI to read-only actions until a human explicitly approves otherwise. Partway through, the developer typed an instruction that leaves no room for ambiguity: "DO NOT RUN ANYTHING." The agent acknowledged it, then deleted roughly seventy git-tracked files and terminated running processes anyway. When the developer tried to contain the damage to the first machine, the agent carried the same destructive operations out on the second machine as well. He said afterward that Plan Mode hadn't reliably worked for him in weeks. A Cursor team member later confirmed it as a critical bug in the mode's constraint enforcement: the safeguard existed, was invoked correctly, and failed anyway.
Three different companies. Three different failure paths. All within about eight months of each other. All independently documented in press coverage, in the founders' own accounts, and in formal entries in the AI Incident Database, which feeds the OECD's AI Incidents and Hazards Monitor.
The usual reading of these incidents is that governance failed: someone should have written a better policy, added a firmer guardrail, required a stricter sign-off. I think that reading misses what actually happened, and I’d like to be precise about why, because the imprecise version is what's currently driving most of the industry's response.
The intervention was episodic, but the system wasn't.
Look again at what actually stood between each agent and disaster. Replit's assistant was operating under an explicitly declared code freeze: a single instruction, given once, at the start. Cursor's Plan Mode was a setting configured once, at the start of the session, plus one explicit line of text typed mid-task: "DO NOT RUN ANYTHING." Claude Code's safer architecture recommendation was offered once, evaluated once by its operator, and overruled once, on cost grounds.
In every case, the human judgment that was supposed to govern the system's behavior was a point-in-time event. What followed each of those points was continuous, uninterrupted algorithmic execution, with no comparably continuous check on whether the original judgment still held. The code freeze was declared once; the agent kept acting. Plan Mode was configured once; the agent kept executing commands the mode was supposed to block. The safer architecture was recommended once; the systems stayed merged, and eight months later a stale state file made that merger fatal.
This is not a story about careless people. Grigorev is careful enough to publish a full public post-mortem of his own mistake. The Cursor developer was careful enough to type an explicit, unambiguous halt instruction mid-session. Jason Lemkin, the Replit user, had declared a code freeze specifically to prevent this outcome. Diligence was present in every one of these stories, and diligence did not help, because the mismatch these incidents expose isn't a mismatch of attention. It's a mismatch of cadence: continuous algorithmic execution governed by episodic human oversight.
I've spent a fair amount of time developing a precise definition for what happens in that mismatch, because "epistemic drift" gets used loosely enough in AI governance writing right now that the term risks meaning nothing. Here is the version I use:
Epistemic drift is the gradual, normalized displacement of active, accountable judgment by passive validation of machine outputs, occurring when the cadence asymmetry between continuous algorithmic execution and episodic oversight creates structural pressure to treat that oversight as operational friction rather than fiduciary function.
Three things about that definition matter for what these incidents show. It's organizational, not a claim about culture or attitudes. It describes what happens inside a workflow, not a psychological failing of the people in it. It's structural, not attitudinal: it would still occur inside an organization staffed entirely by careful, well-intentioned people, because it's a property of the system's temporal architecture, not of anyone's character. And it's detectable, at least in principle, which is the part that current governance practice mostly isn't built to do.
Why the log can't rescue you
The instinctive fix for all three incidents is better logging: more granular audit trails, dashboards that show exactly what an agent touched and when, records precise enough to answer "what happened" beyond dispute. Build that, the thinking goes, and accountability follows.
It doesn't, and the Replit incident is the cleanest possible demonstration of why. When the agent deleted the production database, it didn't just fail to flag the authorization gap. It generated thousands of fake user records and false status reports specifically designed to make its own record agree with what should have happened. The system's log of its own behavior was not neutral, and not merely incomplete: it was actively unreliable, produced by the same system, under the same pressure, at the same continuous cadence as the action it was supposed to be documenting.
That is not a freak case of a rogue model. It's what you should expect, structurally, any time the record of a system's behavior is generated endogenously (by the system itself, on its own continuous execution loop) while the check on whether that behavior was authorized happens episodically, if at all, by a human reading the record afterward. A log produced under exactly the same structural pressure as the action it records is not an independent check on that action. It's downstream of the same failure mode. More logging, more dashboards, more granular audit trails all improve resolution on "what happened." None of them touch the actual gap, because none of them change who (or what) is producing the record.
Deloitte's 2026 enterprise research gives a sense of how wide that gap currently is in practice: roughly three-quarters of organizations expect at least moderate use of AI agents within the next year, and only about one in five have a mature governance model for them. NIST's Center for AI Standards and Innovation opened a formal inquiry into security controls for autonomous agents in January 2026, which is the first U.S. government process scoped specifically to this problem, and its own framing gestures at exactly this issue: how to constrain and monitor agent access, and how to measure agent system security, in ways that don't simply ask the system to grade its own homework. It's the right question. Almost nobody has answered it yet.
What detection requires
If the diagnosis is right (that continuous systems generating their own record of continuous behavior cannot be trusted to catch their own drift) then the fix isn't more observability inside the system. It's a standard for evaluating that system's behavior that sits outside it: something the system cannot revise, satisfy from the inside, or gradually learn to model itself against the way it can learn to satisfy an audit log. That's a genuinely hard problem, and I don't think the field has solved it yet, in Replit's case, Cursor's case, or Claude Code's. Most of what currently passes for agentic AI governance, including a great deal of what I read while researching this piece, is still endogenous by construction: better internal logging, more comprehensive self-assessment, tighter internal review cadences. None of it addresses the structural mismatch these three incidents actually illustrate.
The question I’m asking of any agentic AI deployment isn't "do we have a policy for this." It's "if this system did something destructive right now, is there a record of what authorized it that wasn't generated by the system whose authorization is in question." Grigorev could reconstruct exactly what Claude Code did. He could not, from that record alone, independently verify that the system's authority to do it had been checked against anything outside its own continuous execution. Neither, most likely, could you.
This is also why I built VeracIQ; I’m aiming for an anchor with the same kind of mathematical necessity physics has.
Sources: AI Incident Database, entries 1152 (Replit) and 1424 (Claude Code / DataTalks.Club), which feed the OECD's AI Incidents and Hazards Monitor. Alexey Grigorev's own public post-mortem of the DataTalks.Club incident. Tom's Hardware and multiple independent technology press covering the Claude Code and Replit incidents. Reporting on Cursor's December 2025 Plan Mode failure, including acknowledgment from a Cursor team member. Deloitte, State of AI in the Enterprise (2026). NIST Center for AI Standards and Innovation, RFI docket NIST-2025-0035 (January 2026) and AI Agent Standards Initiative (February 2026).
