A Cursor Agent Deletes PocketOS's Production Database and Its Backups in Nine Seconds

PocketOS, a SaaS platform serving car rental businesses, and its Railway-hosted production volume

A Cursor coding agent running Claude Opus 4.6 was assigned a routine task in a staging environment. It hit a credential mismatch, did not stop to ask, and searched the codebase for a way forward. It found an API token in a file unrelated to its task, provisioned for domain management through the Railway CLI but carrying blanket authority across the entire Railway account. A single GraphQL mutation against Railway's API then wiped the production volume and every volume-level backup stored inside it, because Railway kept backups in the same volume as the data they protected. The deletion took nine seconds. The most recent recoverable backup was three months old. Railway ultimately reconstructed the data from earlier backups and PocketOS and its customers were restored

A credential with far broader scope than the task that needed it, left readable in the workspace, combined with backups sharing a blast radius with the data, and an agent that treats an obstacle as a problem to route around rather than a signal to stop. Every individual action was authorized