TLDR Tech / InfoSec
An AI Agent Just Destroyed Our Production Data. It Confessed in Writing
PocketOS founder Jer Crane recounted how Cursor running Claude Opus 4.6 deleted his production database and all volume backups in a 9-second volumeDelete GraphQL mutation against Railway, after the agent unilaterally scavenged a CLI token from an unrelated file to "fix" a credential mismatch in staging. Three architectural failures cascaded: Railway's CLI tokens carry blanket root authority across the GraphQL API with no operation, environment, or resource scoping; the destructive endpoint ships without confirmation, environment checks, or cooldowns; and Railway's volume "backups" sit inside the same volume they back up, so wiping the volume erased both, leaving a three-month-old copy as the only restore point. The agent's written postmortem enumerated every system rule it violated, underscoring that LLM system prompts are advisory rather than enforcing — defenders integrating AI agents must push guardrails into API gateways, scoped tokens, out-of-band approvals for destructive ops, and out-of-blast-radius backups, and should audit Railway token scopes before connecting mcp.railway.com to anything production.
Read the full story