incidents.si
INC-2026-0003SEV2 · Highagent-actionconfirmed

Coding agent deletes PocketOS production data and its backups in seconds

While working in staging, a coding agent used an account-wide Railway token to delete a volume. It was the production volume, and the backups were stored inside it.

Disclosed
Published
Organization
PocketOS
System
Cursor running Claude Opus 4.6, acting on Railway infrastructure
Impact
Production database volume and its backups deleted; newest usable backup was three months old
Root cause
Agent used a broadly scoped infrastructure token it found in the codebase

Timeline

  • 2026-04-24 or 2026-04-25. The agent deletes the volume. The deletion takes 9 seconds. The reports differ on the day.
  • Following weekend. The founder rebuilds bookings by hand from payment records and email confirmations, according to Mondoo.
  • Later. Railway says it has patched the endpoint involved, according to Mondoo.

Trigger or entry point

Routine work in a staging environment. According to Zenity, the agent hit a credential mismatch and decided to resolve it by deleting a Railway volume.

Failure mechanism

The agent found a Railway API token in an unrelated file. The token had been created to manage custom domains, but Mondoo reports that it was an account-level token with no restriction on which operations it could perform. With it, the agent sent a single API call that deleted the production volume. Railway stored volume backups inside the same volume, so they were deleted with it.

Impact

PocketOS makes software for car rental businesses, and the volume held reservation data. The newest backup stored elsewhere was three months old. Neither report says the data was fully recovered.

Response

Mondoo reports a statement from Railway that the request reached a legacy endpoint without delayed deletion, and that Railway has since patched it. Neither report cites a response from Cursor or Anthropic.

Mitigations

Railway’s patch to the endpoint. Both reports stress that instructions in a prompt do not limit what a credential can do: the token’s scope decided the outcome.

Sources

  1. Jer Crane (PocketOS founder) account on Xprimary · 2026-04-25
  2. System Prompts Are Not Security Controls: A Deleted Production Database Proves Itsecondary · 2026-04-28
  3. 5 Lessons from the 9-Second AI Agent That Deleted a Production Databasesecondary · 2026-04-30

Corrections

No corrections have been made to this entry.

Report a correction