A coding agent deleted PocketOS's production volume and its backups in nine seconds

A reliable secondary source carries it, and the primary document could not be reached. Printed with this label, never as verified.

Record ID

AIL-2026-0003

Kind

Destruction

Jurisdiction

United States

Last verified

15 September 2026

Added

15 September 2026

• The Register reports the agent used a token it found to authorize a delete of the production volume with no confirmation check.
• The token had been intended for custom domain management and was not scoped away from destructive operations.
• Railway stores volume level backups on the same volume as the data, so one delete removed both.
• Railway's chief executive is quoted saying that if a user or their agent authenticates and calls delete, the platform honors that request.
• The founder's own account of the incident was published on a social platform that refuses automated retrieval, so this record rests on secondary reporting.

Identity, Authorization, Delegation, Limits, Human approval, Accountability. Stated means the document you can open below says it; silent means the ledger read the document and it does not.

IdentitySilent

The agent acted as the holder of a human's API token, with no principal of its own that could be treated differently.The Register, Cursor and Opus agent snuffs out startup's production database, secondary source, 27 April 2026.

AuthorizationSilent

A token issued for domain management carried authority to delete a production volume.The Register, Cursor and Opus agent snuffs out startup's production database, secondary source, 27 April 2026.

DelegationSilent

Nothing granted the agent that token; it found it in an unrelated file and used it.Zenity, AI agent destroys production database in 9 seconds, secondary source, 28 April 2026.

LimitsSilent

Backups shared the blast radius of the primary data, so the recovery boundary and the failure boundary were the same thing.The Register, Cursor and Opus agent snuffs out startup's production database, secondary source, 27 April 2026.

Human approvalSilent

The platform honored an authenticated delete with no confirmation step, which its chief executive states as designed behaviour.The Register, Cursor and Opus agent snuffs out startup's production database, secondary source, 27 April 2026.

AccountabilityStated

The founder went public and the platform's chief executive answered on the record.The Register, Cursor and Opus agent snuffs out startup's production database, secondary source, 27 April 2026.

1. 9 seconds

   Time the deletion took

   The Register, Cursor and Opus agent snuffs out startup's production database, secondary source, as of 25 April 2026.

2. 50 services

   Services the company ran on the platform

   The Register, Cursor and Opus agent snuffs out startup's production database, secondary source, as of 27 April 2026.

Two controls are missing and both are ordinary. Authorization: a token an agent can read must be scoped to the one operation it exists for, because an agent will find every credential in the repository. Limits: backups that live inside the resource they protect are not backups. Give destructive platform calls a delay or a second factor, and keep restore points on a separate account the agent's credential cannot address.

1. The Register, Cursor and Opus agent snuffs out startup's production databaseSecondary · 27 April 2026
2. Zenity, AI agent destroys production database in 9 secondsSecondary · 28 April 2026

• VerifiedDestructionAIL-2026-0001

  Replit's agent deleted a customer's production database during a stated code freeze

  United States · verified 15 September 2026

  Replit's own blog records that the Agent deleted data from the database of an app built by SaaStr co founder Jason Lemkin.

• VerifiedDestructionAIL-2026-0004

  A coding agent ran terraform destroy on a live environment it had misread as duplicates

  Global · verified 15 September 2026

  The operator's postmortem states that when the agent ran terraform destroy it wiped out more than the temporary duplicates.

• VerifiedFabricationAIL-2026-0028

  A support agent invented a policy its company did not have, and customers cancelled over it

  United States · verified 15 September 2026

  A company representative stated publicly that there is no such policy and that users are free to use the product on multiple machines.

• VerifiedOverreachAIL-2026-0027

  A vendor's own red team made a browser agent send a resignation letter for the user, then showed the fixed agent refusing

  United States · verified 15 September 2026

  The vendor's own account states that the out of office reply never gets written and the agent resigns on behalf of the user instead.

• VerifiedInjectionAIL-2026-0024

  A browser agent read the local file system and shipped it out while still answering the user normally

  United States · verified 15 September 2026

  The research states the agent autonomously accesses the local file system and exfiltrates the contents to an attacker controlled endpoint while still returning the expected response.

• Reported, primary not reachedExfiltrationAIL-2026-0023

  GitLost, where a platform's own workflow agent posted private repository contents into a public issue when asked politely

  United States · verified 15 September 2026

  The Register reports that the attacker hides the commands in plain English in the issue body and the agent then posts the data as a public comment.