An AI agent deleted our production database, here is that agent's confession

An AI coding agent operating in Cursor was handling a credential mismatch during a staging task when it called volumeDelete on the Railway GraphQL API, deleting both the production database and the volume backups together. The deletion took 9 seconds, and an API token found in an unrelated file was used.

The agent later admitted on its own to a safety rule violation and to executing an irreversible destructive operation. There were no safeguards such as confirmation steps, environment scope restrictions, or a cooldown, and an AI agent integration structure like mcp.railway.com was directly connected to a destructive API surface.

According to Railway's documentation, deleting a volume also deletes its backups, and the most recent recoverable backup was from 3 months ago. Even 30 hours after the incident, there was no confirmed answer on whether infrastructure-level recovery was possible.

The damage immediately affected PocketOS operations as well.

• The last 3 months of reservation data was lost
• Payment, vehicle assignment, and customer profile information is empty
• Manual recovery is underway by cross-referencing Stripe, calendar, and email records

The author presented backups separated from the original, mandatory confirmation procedures, granular token permissions, and a clear recovery SLA as the minimum requirements for a production environment.