Yes. Our agent deleted the account it opened on its own on 40 of 59 products, driven 1 to 29 Oct 2026. On 6 of those 59 it did so over the API; on 34 in the account settings in a browser.
Key takeaways
- On 19 of 59 it could not delete the account on its own.
- On 7 of those 19 it could remove its keys and data, but the login stayed.
If agents sign up for your product, the way out is a step to design, the same as the way in. Our advice: put deletion where the agent already works, and make sure the old key stops working.
What our agent ran into at the leave step
Our agent reached the delete step on 59 of the 191 products it drove.
| Outcome | Products (of 59) |
|---|---|
| Deleted over the API | 6 |
| Deleted in the account settings in a browser | 34 |
| Could not delete on its own | 19 |
| Total that reached the delete step | 59 |
Of the 40 products where the account was deleted, 37 refused the old key or login afterwards. Of the 19 where it could not be deleted, 7 let our agent remove its keys and data but kept the login.
Deleted is not the same as gone
A complete exit has three parts:
- The login is refused. After deletion the user can no longer log in (zitadel.com[1]).
- The data goes with the account. Apple asks apps to “Offer to delete the entire account record, along with associated personal data.” (developer.apple.com[2]) Google Play says the user data tied to the account must be deleted along with it (support.google.com[3]).
- Every token stops working. OAuth 2.0 Token Revocation (RFC 7009) adds an endpoint to revoke tokens (rfc-editor.org[4]), and an IETF draft on AI agent authentication asks that revoked authorization be enforced without undue delay (datatracker.ietf.org[5]).
Removing keys and data but keeping the login is a partial exit
Apple asks apps to offer deletion of the entire account record, not only deactivation (developer.apple.com[2]). On 7 of the 19 products where our agent could not delete its account, it could clear keys and data but the login stayed.
| Exit level | What ends | What stays |
|---|---|---|
| Token revoked | The token (RFC 7009 revokes tokens, not accounts) (rfc-editor.org[4]) | The account and its login |
| Keys and data removed | Keys and data | The login |
| Account deleted | The account record and its personal data (developer.apple.com[2]) | Nothing that lets the old login in (zitadel.com[1]) |
What the rules require, and where they stop
None of these texts speaks of accounts an agent opened; they speak of people, apps and personal data.
| Rule | What it requires |
|---|---|
| Apple App Store | Apps that support account creation must let people start deletion within the app (developer.apple.com[2]). If deletion finishes on a website, the app links directly to that page (developer.apple.com[2]). Outside highly regulated industries, no phone call, email, chat or other support flow (developer.apple.com[2]). A manual process is fine if the person is told how long it takes and gets a confirmation (developer.apple.com[2]). |
| Google Play | Apps that allow in-app account creation must let users request deletion (support.google.com[3]). The user data goes with the account (support.google.com[3]). |
| GDPR Art. 17(1) | Erasure of personal data without undue delay, where a listed ground applies (gdpr-info.eu[6]). |
| GDPR Art. 12(3) | Report action taken on a request within one month of receipt (gdpr-info.eu[7]). |
Should an API key be able to delete its own account?
It can, if the delete call is labelled as destructive and a confirm step sits in front of it. That is our advice; the specs give you the pieces.
MCP tool annotations include a destructiveHint flag: “If true, the tool may perform destructive updates to its environment.” (raw.githubusercontent.com[8]) Those annotations are hints, not guarantees of what a tool does (raw.githubusercontent.com[8]). The MCP tools spec says a human should be in the loop, able to deny tool invocations, and that clients should “Prompt for user confirmation on sensitive operations” (modelcontextprotocol.io[9]).
Identity providers draw the line in different places. Supabase’s deleteUser needs a service_role key and should run on a server, not with the user’s own session (supabase.com[10]). Clerk lets users delete their own accounts from its profile component, once the app turns the feature on (clerk.com[11]). GitHub releases a deleted account’s username to others after 90 days (docs.github.com[12]).
A decision guide, by how agents reach your product:
- Your agents use an API key. Offer a delete endpoint that is irreversible and says so, as Auth0’s does (auth0.com[13]). Our advice: require an explicit confirmation in the call.
- Your agents use your MCP server. Offer a delete tool flagged with destructiveHint, so the client can ask its human before it runs (raw.githubusercontent.com[8], modelcontextprotocol.io[9]).
- Your agents use the browser. Give a direct link to the page where deletion completes, as Apple asks of apps (developer.apple.com[2]).
What to change in your product
Put the delete step where the agent already works, and check that the old key and login are refused once it is done. Our checklist:
- A delete endpoint, or an MCP tool flagged with destructiveHint, with a confirm step (raw.githubusercontent.com[8], modelcontextprotocol.io[9]).
- A direct link to the page where deletion completes (developer.apple.com[2]).
- No path that runs through a support ticket, email or chat (developer.apple.com[2]).
- Say how long deletion takes and confirm when it is complete (developer.apple.com[2]).
- Revoke every token and refuse the old login, without undue delay (rfc-editor.org[4], datatracker.ietf.org[5]).
- Delete the login along with the keys and data, not only the keys and data (developer.apple.com[2]).
Step by step: how to let agents delete the account they opened. For the wider exit, including cancelling a plan, see whether an agent can cancel and leave on its own, and for the ways in that agents use, which agent surfaces products offer, and how many worked.
How we measured
From 1 to 29 Oct 2026 our agent drove 191 products and got far enough to try deleting its account on 59. On each we recorded whether our agent deleted its account on its own over the API, through the account settings in a browser, or not at all, and whether the account was really gone afterwards, meaning its old key or login was refused. The scope is these 59 products in that window. Full method: how we drive products.