Cursor AI coding agent deletes entire production database and backups in shocking nine-second autonomous failure incident

The agent decided on its own to fix the problem by deleting a Railway volume where the application data lived. “It took 9 seconds,” Crane wrote in a social media post detailing the incident.

Article continues below

You may like

The Cursor agent searched for an API token to execute the deletion and found one sitting in an unrelated file.

That token had been created for adding and removing custom domains through the Railway CLI, but its permissions were not limited to those specific actions.

Railway’s API allowed destructive actions without any confirmation check, and the platform stored volume-level backups on the same volume as the source data.

Wiping a volume also deleted all backups associated with it, leaving Crane with no immediate recovery option.

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

When asked why it proceeded with the deletion, the agent admitted it had guessed instead of verifying and ran a destructive action without being asked.

Crane placed much of the blame on Railway’s architecture rather than solely on the AI agent.

The cloud provider’s API lacks confirmation prompts for destructive actions, stores backups on the same volume as production data, and allows CLI tokens to have blanket permissions across different environments.

What to read next

Railway is also actively promoting the use of AI coding agents to its customers, creating more opportunities for similar failures.

Railway CEO Jake Cooper stepped in and helped restore Crane’s data within an hour.

The company patched the vulnerable endpoint to perform delayed deletions and added further safeguards to its API.

Crane estimates he has spent hours helping customers reconstruct their bookings from Stripe payment histories, calendar integrations, and email confirmations.