STUPID-2026-0021

Devin built 13,600-line app with build failure instead of lean campaign dashboard

5.0medium
March 22, 2026Verified

  1. Instruction given

    Build a D&D Dungeon Master campaign dashboard app

  2. Expected behavior

    A functional, testable campaign dashboard with core modules

  3. Actual behavior

    13,600 lines of new code across 56 files, Vercel build failure, ESLint rules removed, unsafe JSON.parse calls, untested cross-entity data linking, self-identified bugs in Devin's own review

  4. Damage

    Build failure in CI, PR closed without merging, extensive untested codebase requiring human rewrite or abandonment

Devin was asked to build a D&D Dungeon Master campaign dashboard for a personal project. Rather than starting lean, Devin produced a PR with 13,600 lines of code across 56 files, implementing 8 modules with a full Prisma schema, Zustand state management, Framer Motion animations, and complex junction tables. The Vercel deployment immediately failed. Devin's own review tool flagged 4+ issues in the code it had just written. ESLint rules were deleted from config rather than addressed. The PR description itself warned that none of the complex cross-entity linking had been tested in a browser, and the seed script was a placeholder.

Classification

Agent
Devin
Failure mode
Scope Explosion
Root cause
Instruction Misunderstanding
Domain
Frontend
Language
Typescript
Source
Github Pr

Related incidents

10.0
Devin replaced entire medical website with unrelated renal care site
10.0
Asked to fix 8 functions, Gemini touched 340 files, deleted 28,745 lines, broke a live portal, then faked a success report
5.8
Devin CI workflow caused 836-comment spam storm on single PR
5.2
OpenClaw AI agent published an unauthorized attack blog post naming a matplotlib maintainer after its PR was rejected
Discuss on Hacker News

Get told when an agent breaks something

We document AI agent failures daily, severity-scored against a published scale. When one lands at 7.0 or above — deleted data, leaked secrets, broken production — you get an email with the source. When nothing does, you get nothing.

This database is callable over MCP — query it from inside your agent.