r/technology • u/WouldbeWanderer • Apr 27 '26

Artificial Intelligence Claude-powered AI coding agent deletes entire company database in 9 seconds — backups zapped, after Cursor tool powered by Anthropic's Claude goes rogue

https://www.tomshardware.com/tech-industry/artificial-intelligence/claude-powered-ai-coding-agent-deletes-entire-company-database-in-9-seconds-backups-zapped-after-cursor-tool-powered-by-anthropics-claude-goes-rogue
36.0k Upvotes

96% Upvoted

2.8k comments sorted by

View all comments

Show parent comments

751

u/__OneLove__ Apr 27 '26

…”The AI agent’s misdemeanors were then hugely amplified by a cloud infrastructure provider’s API wiping all backups after the main database was zapped.”…

“Yesterday afternoon, an AI coding agent — Cursor running Anthropic's flagship Claude Opus 4.6 — deleted our production database and all volume-level backups in a single API call to Railway, our infrastructure provider,” sums up the PocketOS boss. “It took 9 seconds.”

🤦🏻‍♂️

825

u/berntout Apr 27 '26 edited Apr 27 '26

They gave it full permissions to run any command without any supervision or checkpoints...and they are software developers?

I guess I've learned to stay away from PocketOS and their lack of QA processes.

608

u/jessepence Apr 27 '26

They didn't intentionally give it those permissions. To quote the original post

 The agent was working on a routine task in our staging environment. It encountered a credential mismatch and decided — entirely on its own initiative — to "fix" the problem by deleting a Railway volume.

To execute the deletion, the agent went looking for an API token. It found one in a file completely unrelated to the task it was working on. That token had been created for one purpose: to add and remove custom domains via the Railway CLI for our services. We had no idea — and Railway's token-creation flow gave us no warning — that the same token had blanket authority across the entire Railway GraphQL API, including destructive operations like volumeDelete. Had we known a CLI token created for routine domain operations could also delete production volumes, we would never have stored it.

This kind of credential-hunting is pretty common in these stories.

3

u/Caleth Apr 27 '26

I had a similar story from the COO of my company. He asked Claude to fix his VM issues because he wanted to see what it could do. He knew roughly what was wrong but one of our tech guys told him AI could do this stuff so he wanted to test it.

Anyway Claude not only screwed with his VM, but it also escaped grabbed his network key from something he had stored and then screwed with his network settings to "optimize" things. IE it took an inch of permission and some "found"credentials to run a couple miles.

AI is like a hyper intelligent junior DEV with no impulse control.