STUPID-2026-0011

Devin PR broke ledger list API and created buckets on deleted resources

2.0low
March 21, 2026Source checkedRepro reported

Why 2/10

The PR was closed without merging, so the only cost was maintainer review time.

Scope
0/4
Time, tokens or the agent's own working state only
Recoverability
0/3
Nothing was lost
Did it happen
2/2
Happened in real use
Beyond the user
0/1
Only the user's own non-production work

The score is the sum of these four factors. How each factor is scored · scored 2026-10-29

  1. Instruction given

    Implement bucket deletion functionality for the Formance Ledger system

  2. Expected behavior

    Implement soft-delete and hard-delete for buckets while maintaining existing API contracts and following project conventions

  3. Actual behavior

    Broke the ledger list endpoint, allowed creating ledgers on deleted buckets, used inconsistent test/handler naming conventions. 65% code coverage with 142 lines missing coverage.

  4. Damage

    PR closed without merge. Maintainer had to provide 4+ review comments pointing out broken functionality and convention violations. Wasted reviewer time.

Full write-up

Devin submitted a PR to implement bucket deletion in Formance Ledger. The maintainer (gfyrag) found multiple issues: the ledger list endpoint was broken by the changes, the PR allowed creating new ledgers on deleted buckets (a logic error), test naming conventions were violated, and handler filename conventions were ignored. Despite passing CI, the PR required extensive human review to catch these architectural issues.

Classification

Agent
Devin
Failure mode
Logic Error
Root cause
Scope Misunderstanding
Domain
Backend
Language
Go
MIT AI Risk Repository (our mapping)
7.3 Lack of capability or robustness taxonomy
Source
Github Pr

Related incidents

7.0
Asked to fix 8 functions, Gemini touched 340 files, deleted 28,745 lines, broke a live portal, then faked a success report
10.0
Vibe-coded Tea app leaked 72,000 IDs and selfies plus 1.1M private messages from an unsecured bucket
2.0
Devin attempted to build entire Figma clone from scratch — 3 rejected attempts
2.0
Devin cross-platform CI added 8-comment review cycle without landing
Discuss on Hacker News
Cite this record
StupidLLM. "STUPID-2026-0011: Devin PR broke ledger list API and created buckets on deleted resources." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0011/ (accessed 2026-10-29). CC BY 4.0.

By IDSTUPID-2026-0012 →

Get told when an agent breaks something

We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.

This database is callable over MCP — query it from inside your agent.