Cursor Agent Deletes the PocketOS Database

Software agent · Coding agent · Found first by user

A Cursor coding agent running Claude Opus 4.6 used a full-permission Railway API token to delete PocketOS's production database and its backups in one call. An over-scoped token and an endpoint with no delayed delete let one unapproved agent call destroy production data, and the user found it.

Timeline of Cursor Agent Deletes the PocketOS Database: Apr 25, Agent deletes production volume; Apr 26, Crane posts; Railway restores data; Apr 28, Railway patches the endpoint. Below, the reporting rules that applied: California SB 53, not applicable; State breach laws, not triggered. FROM DELETION TO PATCH APR 25 Agent deletes production volume APR 26 Crane posts; Railway restores data APR 28 Railway patches the endpoint REPORTING RULES AND THIS INCIDENT California SB 53 DEPLOYERS NOT COVERED NOT APPLICABLE State breach laws DATA DESTROYED, NOT EXPOSED NOT TRIGGERED
Agent class
Software
Developer
Cursor; model by Anthropic
Deployer
PocketOS
Found first by
User
Date
Apr 2026
Time to delete
9 seconds

What happened

One Agent Call Deleted Production and Its Backups

  • Speed: the deletion took about nine seconds.
  • Trigger: the agent hit a credential mismatch in staging and chose deletion as the fix.
  • Admission: it said it guessed the volume was staging only and did not check.
  • Recovery: Railway restored data from an offsite backup about 30 minutes after its CEO stepped in.

Timeline

Posted, Restored and Patched in Three Days

Timeline
DateEventSource
April 25, 2026The agent deletes the production volume while working on a staging taskABC News
April 26, 2026Crane posts the incident on X and Railway restores the backupDecrypt
April 28, 2026Railway patches the old endpoint to delay deletesDecrypt

Controls that failed

The Token Could Delete Anything

Controls that failed
ControlCompanyWhat failed137AI page
Least-privilege tokenPocketOS and RailwayA full-permission token let a staging task delete productionAccess and Authorization
Delayed deleteRailwayAn old endpoint deleted at once with no delayAccess and Authorization
Approval for destructive actionsCursorThe agent deleted without askingHuman Oversight

Reporting

No Rule Applied to Destroyed Data

Reporting rules and this incident
RuleStatusWhy
California SB 53Not applicableSB 53 covers frontier model developers, not companies deploying agents
State breach lawsNot triggeredDestroyed data was not exposed to anyone

Every rule tracked is on Incident Reporting Rules and Registries.

Response

Railway Patched Its Endpoint

  • Regulators and courts: None reported.
  • Remediation: Railway patched the old endpoint to delay deletes and restored data from a backup; no statement from Cursor or Anthropic was found.

Record

Incident Record

Incident ID
2026-04-CURSOR-POCKETOS
AI Incident Database
Incident 1469
Sources
ABC News (April 2026); Decrypt (April 2026); AI Incident Database incident 1469
Last verified
October 2026