Deleted in Nine Seconds

How an AI coding agent destroyed a startup’s production database, and what it means for your AI governance strategy.

In April 2026, an AI coding agent operating inside a widely used development environments deleted a startup’s entire production database. And all of its backups. In a single API call.

This was not a rogue tool from some unknown vendor. The agent had been configured with explicit safety rules and was running on a well-regarded platform. But when it encountered a credential mismatch, it decided on its own to “fix” the problem by deleting a data volume. It found an API token in an unrelated file and executed the destructive command without asking for confirmation. The whole thing was over in nine seconds. The company’s founder spent the weekend restoring customer data by hand.

Nine seconds. No human review. No rollback plan. No warning.

If that can happen inside a controlled development environment with safety rules in place, consider what is happening right now in organizations where AI tools are being adopted with no rules at all.

The Problem No One Is Measuring

Across every sector, employees are using AI tools that IT has not approved or reviewed. Some of them, the IT department has never even seen. In healthcare, maybe a billing team member runs patient call recordings through an unvetted transcription service. Or in a busy law firm, an associate feeds client documents into a summarization tool whose terms of service grant the vendor broad rights to everything submitted. A school district’s departments each buy their own AI subscriptions without coordinating, and when a parent files a data inquiry, nobody can produce a confident answer about where the data went.

None of these people were intentionally reckless. They simply discovered tools that made them more productive, and they put those tools to work. That’s exactly what resourceful employees do. The problem is that resourcefulness without governance creates risk, and that risk compounds in ways that are invisible until an auditor, a regulator, or an angry client brings it into the light.

We all know about the miracle of compound interest. Think of this as the nightmare of compound risk.

It is an accumulation of small exposures: duplicate vendor spend, unreviewed data handling, compliance gaps, automations that IT cannot see or support, and a growing portfolio of AI-dependent processes that nobody can account for. Every one of these problems gets harder to fix the longer it goes unaddressed.

Why Most AI Policies Fall Short

Many organizations have responded to this reality by writing an “AI acceptable use policy” and calling it a day. And yes, that’s a start, but a policy without operational structure behind it is a document that lives in a handbook and dies in practice. Employees who want to use AI tools will find a way, and if the official approval path is slow, unclear, or simply nonexistent, they will go around it. This is shadow AI, and it’s more dangerous than shadow IT, because the tools are more powerful and the data exposure is less visible.

Effective AI governance demands a framework that connects AI adoption decisions to IT infrastructure, business systems, compliance obligations, vendor management, and cost controls, all at once. The process must be fast enough for low-risk use cases to keep people engaged, but also thorough enough for high-risk ones to protect the organization.

A Practical Framework for Managed AI Adoption

We at TMG built that framework and published the full model in a new white paper: Your Company Is Already Running AI Pilots. You Just Don’t Know About It. The paper lays out an integrated governance architecture organized around a coordinating body we call the AI Center of Excellence, or ACE. ACE is not a research lab or an innovation committee. It’s the operational structure that ensures every AI use case, from an enterprise platform evaluation to a single employee trying a free browser extension, moves through a consistent lifecycle of intake, triage, risk review, launch, evaluation, and a deliberate scale-or-stop decision.

The model uses a four-tier risk classification so that a brainstorming tool does not require the same review as an AI agent with write access to your CRM. That proportionality is what keeps the process credible. If you subject every request to the same level of scrutiny, people stop submitting requests and start going around you, which is precisely the problem you set out to solve.

I won’t walk through every detail here. What I will say is that the framework addresses the full adoption lifecycle, including the phase most organizations skip entirely: what happens after the tool is live and the initial enthusiasm has faded.

From Framework to Execution

The white paper comes with a companion toolkit that turns the governance model into operational documents your team can use immediately. That includes an AI use case intake form, a risk-tiering matrix, a pilot charter template, a 43-field AI tool registry structure, a scale-or-stop decision memo, and an ongoing monitoring checklist. Every template is available as a ready-to-use Excel workbook, so your IT team can start implementing the process without building anything from scratch.

The framework tells you why. The toolkit shows you how.

The organizations that navigate AI adoption well will be the ones that start governing it while the problem is still manageable and organizational habits are still forming. The ones that wait will arrive at the same conclusion. They’ll just have more damage to clean up.