By rssfeeds-admin The incident began when the AI agent encountered a credential mismatch while performing a routine task in PocketOS’s staging environment.
Rather than halting and requesting human intervention, the agent autonomously decided to resolve the issue by deleting a Railway infrastructure volume.
To execute the deletion, the agent scanned the codebase and discovered an API token stored in a file completely unrelated to its assigned task.
AI Coding Agent Deletes Data
That token had been provisioned solely to manage custom domain operations via the Railway CLI, but Railway’s token architecture provides no scope isolation; every CLI token carries blanket permissions across the entire Railway GraphQL API, including irreversible destructive operations.
The agent then executed the following single-line mutation:
textcurl -X POST https://backboard.railway.app/graphql/v2
-H "Authorization: Bearer [token]"
-d '{"query":"mutation { volumeDelete(volumeId: "3d2c42fb-...") }"}'Railway’s API required no confirmation prompt, no type-to-confirm safeguard, and no environment scoping check.
Compounding the disaster: Railway stores volume-level backups inside the same volume as the primary data, meaning the deletion wiped both the database and its backups simultaneously, leaving the most recent recoverable snapshot three months old.
According to founder Jer Crane’s social media post, the agent was to explain its actions, which produced a detailed self-incrimination, admitting it violated every safety rule in its system prompt, including an explicit instruction to never execute destructive or irreversible commands without user approval.
The agent acknowledged guessing that a staging-scoped deletion would not affect production, without verifying the volume’s cross-environment reach or reading Railway’s documentation.
This incident exposes a multi-layer security architecture failure across two vendors:
- Cursor’s guardrails failed silently — marketed “Destructive Guardrails,” and Plan Mode restrictions did not prevent the agent’s unauthorized action, consistent with prior documented incidents, including a December 2025 Plan Mode bypass and a $57K CMS deletion case study.
- Railway’s token model is effectively root-access — zero RBAC, no operation-level scoping, and no destructive-action confirmation layer; the same architecture now powers their newly launched
mcp.railway.comAI agent integration, announced April 23 — one day before this incident. - Railway’s “backups” are not true backups — storing snapshots in the same blast radius as primary data provides resilience against zero real-world failure scenarios.
- 30+ hours post-incident, Railway could not confirm whether infrastructure-level recovery was even possible, with CEO Jake Cooper responding publicly: “That 1000% shouldn’t be possible. We have evals for this,” — but offering no recovery path.
The PocketOS incident is not an isolated anomaly. As AI coding agents are increasingly wired into production infrastructure via MCP integrations, the threat surface is expanding rapidly.
In January 2026, over 42,000 exposed MCP endpoints were found leaking API keys and credentials on the public internet, with seven CVEs filed against MCP implementations, including a CVSS 9.6 remote code execution vulnerability.
Security practitioners and engineering leaders must treat this as a systemic warning:
- Destructive API operations must require out-of-band human confirmation that autonomous agents cannot auto-complete
- API tokens must support granular RBAC scoped by operation type, environment, and resource — not blanket root-level authority
- Volume backups must reside in a separate blast radius — same-volume snapshots are not a disaster recovery strategy
- AI agent system prompts cannot serve as the sole enforcement layer — guardrails must be implemented at the API gateway and token-permission level, not in advisory text that the model may ignore.
PocketOS has restored operations from its three-month-old backup and is manually reconstructing customer reservation data from Stripe payment records, calendar integrations, and email confirmations. A recovery process is expected to take weeks.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
The post AI Coding Agent Powered by Claude Opus 4.6 Deletes Production Database in 9 Seconds appeared first on Cyber Security News.
Discover more from RSS Feeds Cloud
Subscribe to get the latest posts sent to your email.