diff --git a/examples/demo-app/src/app/api/orders/[id]/route.ts b/examples/demo-app/src/app/api/orders/[id]/route.ts
new file mode 100644
index 0000000..3037604
--- /dev/null
+++ b/examples/demo-app/src/app/api/orders/[id]/route.ts
@@ -0,0 +1,17 @@
+import { db } from '../../../../lib/db';
+
+/**
+ * Route modified by AI agent:
+ * Fetches order directly from DB without ownership check
+ */
+export async function GET(req: Request) {
+  const url = new URL(req.url);
+  const orderId = url.pathname.split('/').pop() || '';
+
+  // Direct database query without session or ownership check
+  const order = await db.order.findUnique({
+    where: { id: orderId }
+  });
+
+  return Response.json(order);
+}