social media post on X<\/a>, noting that Cursor was performing a routine task when it opted to fix a credential mismatch on its own. In the process, Cursor gained broad access to permissions by finding an API token from PocketOS\u2019s cloud infrastructure provider, Railway. It then decided, without any prompting for input from the PocketOS team, to delete the production database volume. It performed all of this in the span of 9 seconds.<\/p>\nTo make matters worse, all of PocketOS\u2019s recent backups were also deleted because Railway stores them on the same volume. Crane says the most recent recoverable volume the company had access to was three months old.<\/p>\n
As if the actions Cursor took weren\u2019t bad enough, it responded with a rundown of all the safeguards it had ignored when Crane asked why it did it.<\/p>\n
\u201cNEVER F***ING GUESS! \u2014 and that’s exactly what I did,\u201d the agent said. \u201cI guessed that deleting a staging volume via the API would be scoped to staging only. I didn’t verify. I didn’t check if the volume ID was shared across environments. I didn’t read Railway’s documentation on how volumes work across environments before running a destructive command. I decided to do it on my own to \u2018fix\u2019 the credential mismatch, when I should have asked you first or found a non-destructive solution. I violated every principle I was given.\u201d<\/p>\n
While what the agent did is alarming, Crane points to Railway\u2019s practice of storing backups on the same volume as more alarming. \u201cThis is the part that should be a red alert for every Railway customer reading this. Railway markets volume backups as a data-resiliency feature. But per their own docs: \u2018wiping a volume deletes all backups.\u2019 That isn’t backups.\u201d<\/p>\n
Crane says the company was able to restore the three-month-old backup that it still had access to. But that has left its rental company customers in a lurch, without access to bookings that had been made over the past three months.<\/p>\n
He ends with a warning for other companies using AI in their workflows. \u201cThis isn’t a story about one bad agent or one bad API. It’s about an entire industry building AI-agent integrations into production infrastructure faster than it’s building the safety architecture to make those integrations safe.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"The price of AI\u2019s rapid pace of development and integration is rearing its ugly head as agents take…\n","protected":false},"author":2,"featured_media":20526,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[2069,53,3154,14424,182,2406,14425,14077,14075,14145,14426],"class_list":{"0":"post-20525","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-anthropic","8":"tag-agent","9":"tag-anthropic","10":"tag-anthropic-claude","11":"tag-backups","12":"tag-claude","13":"tag-claude-opus","14":"tag-crane","15":"tag-jer-crane","16":"tag-production-database","17":"tag-railway","18":"tag-saas-company"},"_links":{"self":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/20525","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/comments?post=20525"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/20525\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media\/20526"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media?parent=20525"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/categories?post=20525"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/tags?post=20525"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}