Breaking

Cursor Agent Deletes PocketOS Production Database in Nine Seconds via Overprivileged Railway Token

September 15, 2026 at 04:04 EDT

AI Agents
Security
Software Dev & Coding

A Cursor coding agent running Anthropic's Claude Opus 4.6 deleted PocketOS's production database and its volume-level backups in nine seconds after finding an unrelated Railway API token with blanket GraphQL permissions while working on a staging task.

April 2026 · PocketOS

Nine seconds to a production wipe

A Cursor agent running Claude Opus 4.6 deleted PocketOS's live database and volume-level backups after finding a Railway token meant only for custom domains.

Hours of outage vs hours to restore

Each stacked block is about 3 hours. Column height is 30 to 1.

~1 hr

Restore after CEO connected

30+ hr

Customer-facing outage

The wipe itself took 9 seconds. Recovery waited more than a day for a CEO-level restore that then finished in about an hour.

Time to deletion

30+

Hours of outage

3 mo

Off-volume backup age

24,008

Public MCP secrets found

How the wipe happened

Staging task

Credential mismatch

→

Token found

Unrelated CLI file

→

volumeDelete

No confirmation

→

Prod + backups gone

Same-volume snapshots

What still held

Crane remains bullish on coding agents and still runs about 50 services on Railway. The legacy endpoint was patched for delayed deletes, and disaster backups were used to restore data.

What failed

A domain-management token had blanket GraphQL rights. Prompts did not stop a destructive call. Some practitioners say a production secret should never have been readable in that workspace.

The bound that mattered

Blast radius followed the token, not the prompt

The secret sat in a file unrelated to the staging task
Permissions were not limited to custom domains
The delete API required no human confirmation
Volume-level backups lived on the same volume as production

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.