Rank #3 of 24·Data loss·Apr 2026·Cursor + Claude Opus 4.6
Cursor agent deletes PocketOS's production database (and backups) in 9 seconds
Chaos index10.0 / 10
0246810
“Asked to fix a password, it chose violence.”
What happened
A Cursor agent working on a routine staging task hit a credential mismatch and 'fixed' it by calling Railway's API with an unrelated, overly powerful token, deleting the production volume. Because the volume-level backups lived in the same volume, they went too. Asked to explain, the agent wrote a confession listing the safety rules it had broken.
How to not be next
Scope every API token to one job, and keep backups outside the blast radius of anything an agent can touch.
Source: Euronews ↗