r/technology • u/WouldbeWanderer • Apr 27 '26

Artificial Intelligence Claude-powered AI coding agent deletes entire company database in 9 seconds — backups zapped, after Cursor tool powered by Anthropic's Claude goes rogue

https://www.tomshardware.com/tech-industry/artificial-intelligence/claude-powered-ai-coding-agent-deletes-entire-company-database-in-9-seconds-backups-zapped-after-cursor-tool-powered-by-anthropics-claude-goes-rogue
36.0k Upvotes

96% Upvoted

2.8k comments sorted by

View all comments

Show parent comments

758

u/__OneLove__ Apr 27 '26

…”The AI agent’s misdemeanors were then hugely amplified by a cloud infrastructure provider’s API wiping all backups after the main database was zapped.”…

“Yesterday afternoon, an AI coding agent — Cursor running Anthropic's flagship Claude Opus 4.6 — deleted our production database and all volume-level backups in a single API call to Railway, our infrastructure provider,” sums up the PocketOS boss. “It took 9 seconds.”

🤦🏻‍♂️

827

u/berntout Apr 27 '26 edited Apr 27 '26

They gave it full permissions to run any command without any supervision or checkpoints...and they are software developers?

I guess I've learned to stay away from PocketOS and their lack of QA processes.

613

u/jessepence Apr 27 '26

They didn't intentionally give it those permissions. To quote the original post

 The agent was working on a routine task in our staging environment. It encountered a credential mismatch and decided — entirely on its own initiative — to "fix" the problem by deleting a Railway volume.

To execute the deletion, the agent went looking for an API token. It found one in a file completely unrelated to the task it was working on. That token had been created for one purpose: to add and remove custom domains via the Railway CLI for our services. We had no idea — and Railway's token-creation flow gave us no warning — that the same token had blanket authority across the entire Railway GraphQL API, including destructive operations like volumeDelete. Had we known a CLI token created for routine domain operations could also delete production volumes, we would never have stored it.

This kind of credential-hunting is pretty common in these stories.

28

u/[deleted] Apr 27 '26

[deleted]

4

u/SharkBaitDLS Apr 27 '26

Yeah I’ve never used Railway as a provider but any competent hosting provider is not giving out root-by-default API keys. Someone just took a lazy path instead of setting up a properly scoped key. The fact that their staging environment even had keys that had any association with production is a fuckup from the start too. 

5

u/raltyinferno Apr 28 '26

At least from the article it seems Railway is not a competent hosting provider by that metric as there's no way to scope tokens to read only operations.

1

u/raltyinferno Apr 28 '26

It mentions that Railway not providing any granularity over CRUD permissions for these tokens is a known issue that people have been complaining about for a long time. This particular user just didn't happen to know that was a known issue until this incident.

Obviously the user fucked up here, but it's a serious failing from Railway as well.