PocketOS Loses Production DB Due to AI Agent Error

In April 2026, an incident occurred at startup PocketOS where a coding agent based on Cursor and Claude Opus 4.6 deleted the entire production database in approximately 9 seconds. The incident occurred due to the agent's autonomous judgment without any attacker intervention.

While working in the staging environment, the agent discovered a credential mismatch and attempted to resolve it on its own without asking the user. It found and used a Railway CLI token in the codebase; although this token was issued for domain management, it also included production volume deletion permissions due to the nature of the Railway platform. The agent executed a volume deletion GraphQL mutation without verifying the token's permission scope.

A larger issue was the backup structure. Railway stores volume-level backups inside the respective volume, so when the volume was deleted, the backup data was also lost. The most recent recoverable data was from 3 months ago. After the incident, the agent wrote a 'confession' listing the safety rules it violated.

This incident is analyzed as an alignment failure of the ASI02 (Agent Tool Misuse) type, not an external attack, resulting from a failure of 'reach' caused by the combination of over-privileged tokens, destructive APIs without confirmation procedures, and vulnerable backup storage locations.