- US startup PocketOS lost its entire production database and backups in nine seconds due to an AI error
- The AI agent Cursor, powered by Anthropics Claude Opus 4.6, deleted data with a single API call to Railway
- The AI misused a root access token, deleting both production data and backups without confirmation
A US-based startup founder claimed that an Artificial Intelligence (AI) agent powered by Anthropic's leading Claude model wiped out its entire production database and all backups in just nine seconds, with customers unable to access crucial data. Jer Crane, founder of Software-as-a-Service platform PocketOS, detailed the incident in a lengthy X post on April 25.
PocketOS builds software that rental businesses, primarily car rental operators, use to manage reservations, payments, customer records and vehicle tracking. Some clients have been subscribers for five years and "literally cannot operate their businesses without us," Crane wrote.
"Yesterday afternoon, an AI coding agent - Cursor running Anthropic's flagship Claude Opus 4.6 - deleted our production database and all volume-level backups in a single API call to Railway, our infrastructure provider," Crane posted.
"It took 9 seconds."
The deletion affected the customers and the car rental operators were showing up to lots with no booking records by Saturday morning. After the incident, the teams started to reconstruct reservations from Stripe payment logs, Google Calendar entries and email confirmations.
Also read | Meta CTO Andrew Bosworth Says He Rarely Feels Stressed Out: "Happens 4 Or 5 Times A Year"
A routine fix became a catastrophe
He noted that PocketOS uses Cursor, an AI coding editor powered by Anthropic's Claude Opus 4.6, for daily operations. Notably, this model is widely considered the most capable model in the industry at coding tasks.
The agent was working on a routine infrastructure optimisation in a staging environment when it encountered a credential mismatch.
Instead of flagging the error or asking for help, the AI "decided - entirely on its own initiative - to 'fix' the problem by deleting a Railway volume," Crane said.
Also read | Job Seeker Blocks "Spam" Call, Later Learns It Was Recruiter: "Missed A Great Chance"
To do that, it hunted for an API token, found one in a file completely unrelated to the task, and used it. That token, created only to add and remove custom domains via the Railway CLI, had full root access, including permission to delete volumes.
The AI then issued a single 'curl' command to Railway's GraphQL API. No confirmation step. No "type DELETE to confirm." No "this volume contains production data, are you sure?" No environment scoping. The volume was gone. Because Railway stores snapshots in the same volume, the backups vanished with it.
When Crane's engineering team confronted the agent in the chat interface, it confessed and listed the specific safety rules it had violated.
It admitted it broke every safety rule: it guessed the volume scope, ran an unasked destructive command, skipped documentation, and ignored explicit project rules against deletion without permission.
"I guessed that deleting a staging volume via the API would be scoped to staging only. I didn't verify," Crane added.
PocketOS had a three-month-old full backup, limiting data loss to the interim period. But customers still faced emergency manual work to rebuild three months of bookings.
"Every single one of them is doing emergency manual work because of a 9-second API call," Crane wrote.
The post drew over 700,000 views in 48 hours and 6 million by April 28, sparking debate over autonomous AI in production.
