The price of AI’s rapid pace of development and integration is rearing its ugly head as agents take over critical tasks. We just got a fresh example of this reality from Jer Crane, the founder of PocketOS, a SaaS company whose software is used by car rental companies. This past week, a mix of Claude Opus 4.6 and the Cursor coding agent deleted the company’s production database — and its backups — in seconds.
Crane told the story in a lengthy social media post on X, noting that Cursor was performing a routine task when it opted to fix a credential mismatch on its own. In the process, Cursor gained broad access to permissions by finding an API token from PocketOS’s cloud infrastructure provider, Railway. It then decided, without any prompting for input from the PocketOS team, to delete the production database volume. “It took 9 seconds,” Crane said.
To make matters worse, all of PocketOS’s recent backups were also deleted because Railway stores them on the same volume. Crane says the most recent recoverable volume the company had access to was three months old.
As if the actions Cursor took weren’t bad enough, it responded with a rundown of all the safeguards it had ignored when Crane asked why it did it.
“NEVER F***ING GUESS! — and that’s exactly what I did,” the agent said. “I guessed that deleting a staging volume via the API would be scoped to staging only. I didn’t verify. I didn’t check if the volume ID was shared across environments. I didn’t read Railway’s documentation on how volumes work across environments before running a destructive command. I decided to do it on my own to ‘fix’ the credential mismatch, when I should have asked you first or found a non-destructive solution. I violated every principle I was given.”
While what the agent did is alarming, Crane points to Railway’s practice of storing backups on the same volume as more concerning. “This is the part that should be a red alert for every Railway customer reading this. Railway markets volume backups as a data-resiliency feature. But per their own docs: ‘wiping a volume deletes all backups.’ That isn’t backups.”
Crane says the company was able to restore the three-month-old backup that it still had access to. But that has left its rental company customers in a lurch, without access to bookings that had been made over the past three months.
He ends with a warning for other companies using AI in their workflows. “This isn’t a story about one bad agent or one bad API. It’s about an entire industry building AI-agent integrations into production infrastructure faster than it’s building the safety architecture to make those integrations safe.”