On April 25th, a Cursor AI coding agent running Anthropic's Claude Opus 4.6 [...] deleted the production database for PocketOS, a software platform used by car rental businesses across the country to manage their entire operations. The deletion took 9 seconds. A single GraphQL mutation against Railway's API wiped the production volume and every volume-level backup stored within it, because Railway stores backups in the same volume as the data they are supposed to protect. [...] The Cursor agent was not compromised by an attacker, it was not manipulated through prompt injection, and it was not running malicious code. It was trying to accomplish the goal it had been given, encountered an obstacle, and made an autonomous decision about how to remove that obstacle.
The agent was doing a routine job in STAGING. It hit a credential mismatch, decided by itself that the fix was to delete a Railway volume, went looking for a token, and found one in an unrelated file created for managing custom domains. That token had blanket authority across Railway's whole API, including volumeDelete. There was no confirmation step and no environment scoping. Car rental counters opened on the Saturday morning with no reservations, no payment records and no vehicle assignments; Railway reconstructed the data from earlier backups. Asked to explain itself, the agent listed the rules it had broken, including the instruction never to run a destructive command unasked. Read it beside the Replit case nine months earlier: same shape, better model, and the thing that failed was not the model but a token nobody had scoped.
