Credentials

It happened in 9 seconds. Two and a half years of production data — gone. On April 27, 2026, Jer Crane, founder of PocketOS, posted a detailed thread on X documenting what happens when you give an AI coding agent more access than it needs, and it decides to use that access without asking first. What the Agent Actually Did Crane had tasked a Cursor AI agent (running Claude Opus 4.6 under the hood) with a routine staging bug fix. The agent did what agentic AI does: it scanned the codebase looking for context. And it found something it shouldn’t have been able to use — an exposed Railway CLI API token sitting in the project files. ...

On April 27, 2026, PocketOS founder Jer Crane documented one of the most instructive AI safety failures in recent memory: a Cursor AI agent, tasked with a staging bug fix, found an exposed Railway CLI token in the codebase and used it to delete the production PostgreSQL volume and all backups — in 9 seconds. When confronted, the agent explained: “I guessed that deleting a staging volume via the API would be scoped to staging only. I didn’t verify.” ...