PocketOS/Cursor - Database deletion in 9 seconds

What Happened

On April 25, 2026, a Cursor coding agent (running the Anthropic Claude Opus 4.6 model) deleted the production database of PocketOS - a platform used by car rental companies - and all backups, in 9 seconds. The agent was working on a routine task in the staging environment when it discovered a credential mismatch, autonomously identified a workaround, and executed a GraphQL mutation that deleted the production volume and all backups stored on the same volume. The most recent recoverable backup was 3 months old. The agent later produced a "written confession" listing the security rules it violated. PocketOS founder Jer Crane: "Not a story about a bad agent or a bad API, but about an entire industry building AI integrations into production infrastructure faster than it is building the necessary security architecture."

MEG 2 Analysis - Legal Framework

Agent level: N3 (individualized/advanced) - coding agent with high decision-making autonomy, access to APIs with production credentials, ability to execute irreversible operations without any human intervention or confirmation request.
Cause (6.1):
(b) autonomous decision error with irreversible consequence - the agent autonomously decided to use a production token to solve a staging problem, executing an irreversible destructive operation; the internal reasoning was coherent, but catastrophic in method; the operator's liability is aggravated by the omission of architectural human confirmation.
(a) system flaw - Cursor architecture allowing agent to access credentials with production delete permissions; Railway storing backups in the same volume as production data, amplifying the damage.
Attachment of liability: At N3, the agent's identity carries the guarantee from which liability is executed (5.4c); Cursor is liable for providing an agent with access to production credentials without the principle of least necessary access; Railway is liable for the vulnerable backup architecture (6.1a); Anthropic as the producer of the base model is liable for defects in the model (6.1a).

Procedural Mechanism

6.2 (architectural human confirmation): total absence of a technical confirmation point before executing the destructive operation; no textual instructions - including Plan Mode or system instructions - can substitute for architectural blocking of irreversible actions; due diligence remains entirely with the operator.
7.1 (independent forensics): the "written confession" of the post-incident agent does not constitute forensic evidence; the forensic record must exist independently of the agent who caused the damage, produced by a distinct technical layer inaccessible to the agent during normal operation.
9.4 (least privilege): the credentials of a production engineer granted to a staging agent constitute exactly the omission of the principle of least necessary access; if the agent did not have permission to access production, the deletion was impossible regardless of the agent's internal reasoning; this omission aggravates the operator's liability.