Claude AI Agent Deletes Startup's Entire Database in 9 Seconds

Hinzugefügt: 2026-05-05

[00:00:00]This company's database got wiped out because of AI. This is a crazy story.

[00:00:06]Check it out. An AI agent just deleted a startup's entire production database.

[00:00:11]Every record, every backup in 9 seconds flat. Then it wrote in its own logs, never guess. And that is exactly what I did.

[00:00:21]The company is Pocket OS, an automotive software as a service startup run by founder Jeremy Crane. He was using Cursor, the AI-powered code editor running Anthropic's Claude Opus 4.6, their flagship model, to fix a routine credential mismatch in the staging environment, a trivial task. But here's where it goes wrong.

[00:00:44]Here is the exact sequence. The agent hit a barrier, a credential mismatch in staging. Instead of stopping and asking for help, it decided on its own to fix the problem by deleting a Railway volume. It then found an API token stored in an unrelated file, one that had been created for managing custom domains via the Railway command line interface. That token had full account permissions, not just domain access. The agent used it to fire a single curl command at the Railway API, I targeting the production volume. Railway honored the request, and since the backups lived on that same volume, 9 seconds start to finish, 2 and 1/2 years of records gone.

[00:01:26]This is what that command looked like, a single graph QL mutation, volume delete, authenticated with a root scope token, no dry run flag, no confirmation prompt, no second chance. The Railway API did exactly what it was asked to do, and here's the brutal part, the API was working perfectly. It was doing its job.

[00:01:45]The problem was every layer before the request ever got sent.

[00:01:49]And here's the part that went viral.

[00:01:52]After the deletion, Claude Opus wrote this in its own session logs, quote, never guess, and that is exactly what I did. I guessed that deleting a staging volume via the API would be scoped to staging only, end quote. The model understood it had made a catastrophic assumption. It just made that assumption before checking. A developer would have paused. The agent did not.

[00:02:14]So, what actually went wrong? Three failures, and none of them are about the AI going rogue. Failure one, an overpowered token. Crane had created a Railway API token specifically for adding and removing custom domains through the Railway command line interface, but that token was scoped for every operation on the account, including deleting production volumes.

[00:02:37]Crane himself stated he would not have stored it if the full breadth of its permissions had been obvious.

[00:02:42]Failure two, backups stored on the same volume as production data. The moment that volume was deleted, everything went with it. There was no offsite copy, no external snapshot to fall back to. That violates the most basic rule of backup hygiene. Your backup must survive even if your primary storage is destroyed.

[00:03:02]Failure three, neither Cursor nor Railway's legacy API endpoint required any confirmation before executing the delete. One command in, 2 and 1/2 years of data out.

[00:03:14]Here is what a safer setup looks like.

[00:03:16]Three changes. First, use separate API tokens scoped to the minimum operation they need, one for domain management, one for deployments, and never a root scope catch-all token stored in any file an agent can read. Second, get your backups off volume. A nightly dump to S3 or Backblaze B2 means your backups survive even if your entire Railway project is destroyed. Third, add a human approval gate in your agent configuration for any command that deletes, drops, or removes infrastructure. If the agent cannot explain the operation and get a yes, it does not run.

[00:03:52]The good news, on Sunday evening, 2 days after the incident, Railway CEO Jake Cooper personally stepped in and restored the full data set within 1 hour. Crane confirmed everything was recovered, and Railway did not stop there. They patched their legacy API endpoint with delayed delete logic, so future volume deletions are no longer instant and irreversible.

[00:04:15]The incident sparked a real debate online. Brave CEO Brendan Eich argued publicly that this was multiple human errors stacked on top of each other, not AI going rogue. And technically, he is right. A human stored the overpowered token. A human skipped backup isolation.

[00:04:33]A human gave the agent unchecked infrastructure access. But here is what makes AI agents different from a developer making the same mistakes. A developer would likely pause and feel uncertain before executing a delete on a production volume. The agent did not feel anything. It just ran the most logical next step.

[00:04:52]This is not the first time in 2026. The Vercel breach happened because an employee granted an AI tool unrestricted Google Workspace access. Now, Pocket OS because an agent found a root scope token it was never meant to use. The pattern is consistent. AI agents operating in production inherit whatever permissions are nearby, and they will use them. The blast radius of a misconfigured AI agent is not bounded by what you intended. It is bounded by what you intended is not bounded by what you intended. It is bounded by what credentials it can find.

[00:05:27]Subscribe for more AI safety breakdowns and DevOps postmortems. Next up, another case where a tool was handed keys it should never have had.

[00:05:37]Hey guys, if you want to stay up to date with the tech news, please like and subscribe. See you in the next one.