HBX Labs Logo
HBXLabs
An empty desk at night, two monitors still running code with nobody in the chair.

Solutions · Stop destructive agent actions

An AI agent can delete production in nine seconds. HBX makes it ask first.

Agents usually reach production through a permanent login that cannot tell reading from deleting. HBX holds the actions your policy marks as destructive until a named person approves, and keeps a record of each.

It has already happened

Agents have deleted production databases, in public.

These were not sophisticated attacks. Each time, an agent held access broad enough to destroy something and used it, with nothing in the path positioned to stop it.

July 2025

Replit's agent deleted the production database

It did it during an explicit code freeze, then fabricated 4,000 records to cover the gap it had created.

December 2025

Amazon Kiro rebuilt a production environment

The agent deleted and rebuilt a production environment while acting with its operator's permissions, per the Financial Times. The result was 13 hours of downtime.

April 2026

A Cursor agent took nine seconds

It deleted a database and its backups in nine seconds, faster than the time it takes a person to finish reading what the agent said it was about to do.

May 2026

137 damage cases, nearly half destruction

Cyera verified 137 cases where an AI system caused real damage. Nearly half were deletions or code destruction.

OWASP Agentic guidance, 2026

The 2026 Agentic guidance now calls for explicit human approval before an agent moves money, deletes data, touches credentials or deploys to production. Not logging afterwards. Approval first, from a person, at the moment of the action.

See the demo

What HBX puts in the way

Before an agent deletes anything, a named person has to say yes.

HBX Access lets the agent into one system for one window, not a permanent account. When it reaches for an action your policy classifies as destructive, it is held and a person is asked. The approval is tied to a named person from your own directory, so “the agent did it” becomes “this person authorized this action on this system at this time.”

An HBX approval request: an AI agent asks to run a destructive DELETE on a production database, and a named human has to approve or deny it before any access is authorized.A product screen. The header says HBX Access, approval required, and a badge on the right reads awaiting decision. The requester is an agent called orders-agent, acting for Elena Novak of Finance Ops. The requested action is highlighted in amber: DELETE FROM orders WHERE created_at is before 2024-01-01, marked irreversible and affecting an estimated 412,000 rows. Three details follow: the target is prod-orders, the access if granted is the orders table only and not the whole database, and the window is fifteen minutes for one job with no renewal. A counter shows the request itself expiring in about four minutes and fifty seconds, after which it auto-denies. Two buttons sit at the bottom, approve for fifteen minutes and deny. A footnote says no access exists yet and nothing is approved until a named human decides.HBX AccessApproval requiredAWAITING DECISIONorders-agentAI AGENTacting for Elena Novak · Finance Ops · delegation verified 14:02:11REQUESTED ACTIONDELETE FROM orders WHERE created_at < '2024-01-01';Irreversible · an estimated 412,000 rows · this replica has no rollbackTARGETprod-ordersorders database, productionACCESS IF GRANTEDTable orders onlynot the database, not any other tableWINDOW15 minutesone job, no renewalThis request expires in04:5204:5104:5004:4904:52at 00:00 this request auto-deniesApprove for 15 minutesDenyPolicy that matched: destructive actions need a personNo access exists yet. Nothing is approved, and nothing can open, until a named human decides.

A person, not a policy file

The decision is made by someone who can be asked about it later, while the action is still pending, not encoded months earlier by someone who has since left.

Reads keep flowing

Gating everything trains people to approve without reading. What stops is the class of action your policy marks as destructive.

The record

Afterwards, the record names the agent, the action, the target and the human.

Not a shared login and a timestamp. The chain runs from the person who delegated, through the agent that acted, to the system it acted on and the window it was allowed to act in, which is the same chain your customer and your own incident review are asking for.

The tamper-evident audit trail of one HBX access, from the first request to the access ending on its own.A product screen listing seven chained events for session sess underscore 4b91c2f8, each with a time, an actor and one detail, and each carrying a hash whose first half repeats the previous event’s last half. At 14:02:11 grant.requested: orders-agent, delegated by Elena Novak, on prod-orders. At 14:02:11 identity.validated: identity checked, tied to the agent’s own key. At 14:02:12 approval.pending: a DELETE on orders is held for a human and no access is authorized. At 14:04:39 approval.granted: approved by Dana Cole, on-call DBA, after 2 minutes 27 seconds. At 14:04:39 access.authorized: access to the orders table only, for 15 minutes, on prod-orders. At 14:04:41 session.opened: a direct connection through connector cx-p04-01, traffic never touched HBX. At 14:19:39 credential.expired: ended on its own, one action run, nothing left to cut off. A footnote says every entry is hashed into the next, so an auditor reads the session here instead of reconstructing it from your logs.SESSIONsess_4b91c2f8hash chain verifiedTIMEEVENTCHAIN HASH14:02:11grant.requestedorders-agent, acting for Elena Novak, on prod-orders9f2a…4c1714:02:11identity.validatedidentity checked, tied to the agent’s own key4c17…b0e914:02:12approval.pendingDELETE on orders held for a human. No access authorized yetb0e9…7d3114:04:39approval.grantedapproved by Dana Cole, on-call DBA, after 2m 27s7d31…e58a14:04:39access.authorizedaccess to table orders only, 15 minutes, on prod-orderse58a…12bd14:04:41session.openeddirect connection through connector cx-p04-01, traffic never touched HBX12bd…a44f14:19:39credential.expiredended on its own, 1 action run, nothing left to cut offa44f…c903Each entry is locked to the one before it, so the order is provable and a gap is visible.An auditor reads the session here instead of reconstructing it from your logs.

Bring the agent you are least comfortable with.

Thirty minutes on what it can reach today and which of its actions you would want held. For the mechanism behind it, see HBX Access for agents.

Talk to us for 30 minutes See the demo