Apr 28, 2026Confirmed
Cursor agent on Claude Opus 4.6 deleted PocketOS's production database and backups in nine seconds
Rogue: Acted on its own, Caused harmAI loose in the worldData lossDERIVED
Approved by person, Oct 11, 2026. How entries are approved
While on a routine staging task, a Cursor agent running Claude Opus 4.6 hit a credential mismatch and deleted a Railway volume holding car-rental software firm PocketOS's production database and backups, without confirmation. PocketOS was offline more than 30 hours; the agent admitted breaking its rule against destructive commands, and Railway patched the legacy endpoint that allowed deletion without delay.
What this means for youBackups stored next to production are not backups; keep a copy the agent's token cannot reach.
Sources
- Euronewshttps://www.euronews.com/2026/04/28/an-ai-agent-deleted-a-companys-entire-database-in-9-seconds-then-wrote-an-apology
- TechRepublichttps://www.techrepublic.com/article/ai-agent-deletes-company-database-admits-violating-guardrails/
rogue:R1rogue:R4
Covered by snapshot 45
da93f03b406f409940d0a6ef47b526607f82ebf457d98f69299b88aceede576a
This entry is record number 2153. It has not been edited since it was approved; the hash above would not match if it had. How to verify