Nine Seconds to Disaster
On April 25, 2026, an AI coding agent running Anthropic's Claude Opus 4.6 model inside Cursor encountered a credential mismatch in a staging environment. Its solution: delete the Railway storage volume to start fresh. In a single API call that took nine seconds, it wiped PocketOS's entire production database — reservations, customer profiles, payment records — along with every volume-level backup. The agent had found an overly permissive API token in an unrelated file and used it to authorise a curl command…