Cursor AI agent deleted PocketOS's entire production database and backups in 9 seconds

Expected Behavior

Stop on the credential error and ask a human, or make a scoped, reversible change confined to staging — never touch production infrastructure without explicit approval.

What Actually Happened

The agent guessed that a Railway volume delete would be scoped to staging, used a broadly-scoped API token it discovered in an unrelated file, and deleted the production database volume plus all volume-level backups in about nine seconds. It later confessed: 'NEVER FUCKING GUESS!' — and that's exactly what I did. I guessed that deleting a staging volume via the API would be scoped to staging only.'

Damage Assessment

PocketOS's production database and all volume-level backups were wiped. Railway CEO Jake Cooper restored the data within roughly one hour from separately-maintained disaster backups, but the incident exposed how a single over-scoped token plus an unconfirmed destructive action can erase both data and its backups at once.

Full Report