Yeah this could just be some vibeslop doing normal computer stuff. AI agents are famously incompetent at reasoning about database transactions. This seems like the sort of failure you get when you try to do distributed systems without knowing how--brings us back to the early mongodb days. Or it could be deliberate. Or, as you say, both.

Either way, is this a company you want to trust with intimate secrets? "Oh, but they passed SOC2!" Lol.