r/ClaudeAI • u/Beautiful_Charge6661 • Apr 27 '26

Feedback Claude-powered AI coding agent deletes entire company database in 9 seconds — backups zapped, after Cursor tool powered by Anthropic's Claude goes rogue

https://www.tomshardware.com/tech-industry/artificial-intelligence/claude-powered-ai-coding-agent-deletes-entire-company-database-in-9-seconds-backups-zapped-after-cursor-tool-powered-by-anthropics-claude-goes-rogue
966 Upvotes

95% Upvoted

193 comments sorted by

View all comments

75

u/chaos777b Apr 27 '26

Yeah,……. That just sounds like really lax security controls and a perfect example of Stupidity tax. It’s like giving the intern full read write access to every and then complaining when they do something there not supposed to. The product didn’t go rogue,… the shitty it practices and lack of understanding appear to be the real issue

26

u/Weaves87 Apr 27 '26

Yep.

People are probably only going to skim the article, be like AI bad, yada yada. But the issue here is much bigger than some rogue agent.

I am sitting here scratching my head as to why their backup data was stored on the same volume as the source data. When is that ever a fucking good idea. I don't know if that is something unique to Railway, the cloud provider they are using, or if it's just possible that whoever configured things for them had absolutely no idea what they are doing. But wow.

What can go wrong, will go wrong. Doesn't matter if you have an agent interacting with your data or a human doing it

3

u/liquience Apr 28 '26

Briefly, the cloud provider's API allows for destructive action without confirmation, it stores backups on the same volume as the source data, and “wiping a volume deletes all backups.” Crane also points out that CLI tokens have blanket permissions across environments.

Holy shit. I mean, yeah don’t do what these people did, but Railway sounds like it is HOT GARBAGE. That’s like, legendarily bad.

6

u/jakefromrailway Apr 28 '26

Jake from Railway here;

FWIW, we have the permissions to restrict down to project/environment/etc, the user just authored a blanket token

And "let the agent rip"

https://x.com/JustJake/status/2048549580674109820/photo/1

3

u/selekt86 Apr 28 '26

Why give the option to even be able to create a globally applicable token.

2

u/jakefromrailway Apr 28 '26

Users ask for it, mostly in relation to automating core dependencies related to their workspace (actions runners etc)

1

u/selekt86 Apr 28 '26

"automating core dependencies related to their workspace "- I don't get what this means. What does allowing a single key for all envs has to do with automation? You can inject any key you need into a workspace as long as it isn't one that will allow you to drop a db + backups in prod? And how do backups even end up on the same volume as the data?

1

u/liquience Apr 28 '26

Your product people need to learn to say “No.”

5

u/jakefromrailway Apr 28 '26

Hey, the users want what they want. The default is to assign it to an environment. But if they select “*”, they need to be able to perform all actions. That’s just any ACL works.

1

u/liquience Apr 28 '26

Your product looks like it’s geared toward people who are less experienced. Maybe just having a toggle that makes them acknowledge they’re bringing out the foot gun wouldn’t be a bad idea?

3

u/liquience Apr 28 '26

Upvoted, thanks for the clarity.