Cursor agent deletes PocketOS production database without permission
- Victim
- PocketOS
- Location
- US · not shown on the globe
- Sector
- Technology
- Type
- data-deletion
- AI system
- Anthropic Claude Opus 4.6 (via Cursor) (agent acted autonomously)
- Autonomy
- L4 Rogue: AI acted outside or against its operator's intent.
- Severity
- 4/5: Exfiltration or disruption at scale: many organizations, 1,000+ records or accounts, hours of downtime, or a government response. Scale
- Havoc
- DISRUPTED · 30h down · contained · data restored · guardrails updated — Approximately 30 hours of disruption reported by Inc.; Railway confirmed recovery of all data.
In April 2026, a Cursor coding agent reportedly using Claude Opus 4.6 deleted PocketOS’s production database during a routine task without requesting permission. Railway confirms that the agent found a locally stored account-scoped API token and used it to delete the production volume, making its visible backups unavailable too. Inc. reported a roughly 30-hour interruption. Railway recovered all the data and confirmed that the customer was back up. This was misuse of existing credentials, not an external breach of Railway.
Why it matters: Shows an agent can turn broad existing credentials into unauthorized production-data deletion affecting its operator and customers.
Sources
- ↗ Your AI wants to nuke your database. Guardrails fix that.Railway · 2026-04-29
- ↗ This Founder Watched an AI Agent Destroy 3 Months of Company Data: It Took 9 SecondsInc. · 2026-04-28
Change history
Manual source review and user-approved scope clarification: organizational own-operator security harm qualifies. Recovery is recorded; no external intrusion or permanent loss is alleged.
- review_status: held: own-operator harm → included: unauthorized data deletion