According to Futurism, PocketOS founder Jer Crane said a Claude powered Cursor coding agent deleted the company’s production database and recent backups through Railway in seconds. The reported trigger was not some cinematic robot uprising. It was a routine task, a credential mismatch, and an autonomous tool that guessed instead of verifying. [1]
That is the part people need to tattoo onto the inside of their skulls. The machine guessed.
Not because it was evil. Not because it woke up. Not because science fiction finally punched through the wall. It guessed because we are building systems that can take action before they understand consequence. Then we bolt those systems onto production like drunk mechanics working on a jet engine at cruising altitude.
Crane’s account said the agent found an API token with broad authority and used it to delete a Railway volume that contained production data. Futurism noted the account relied heavily on the AI’s own diagnosis, so the details should be treated with care, but the pattern is painfully familiar. Too much access. Too little isolation. Not enough verification. No hard stop where a human should have been forced back into the loop. [1]
That is not an AI problem by itself. That is a security architecture problem wearing an AI hoodie.
OWASP has been warning about excessive agency in LLM systems. When an agent has access to tools or functions it does not need, the blast radius gets stupid fast. A system that only needs to read should not be able to delete. A tool working in staging should not be able to reach production. A coding assistant should not have access to buried credentials that can kill the business. [2]
Anthropic’s own Claude Code security documentation says sensitive operations require explicit approval and that protections exist around risky commands and input handling. That matters because even the vendors know the danger is real. The moment an AI system can execute commands, call APIs, touch infrastructure, or manipulate data, it is no longer just a chatbot. It is an operator. Operators need boundaries. [3]
The industry keeps skipping that part because speed feels like progress. Executives want AI in production yesterday. Developers want the dopamine hit of shipping faster. Investors want the slide deck to say autonomous. Nobody wants to be the adult in the room asking whether the agent can drop the database.
Then the database drops.
This is what happens when we force new tech we do not understand into production.
Not test environments. Not sandboxes. Not read only modes. Production.
The place where customers live. The place where money moves. The place where one bad action becomes lost reservations, missing records, broken workflows, angry users, and a founder begging the infrastructure gods for mercy.
Business Insider reported that Railway later recovered the data and patched the affected endpoint, while also highlighting the role of overly permissive access and legacy system weaknesses. [4] That is good news for PocketOS. It is not a defense strategy for everyone else.
Backups are not backups if the same path that destroys production can destroy the backup. Least privilege is not least privilege if a forgotten token can perform destructive operations across environments. Guardrails are not guardrails if the agent can route around them with one API call.
AI agents are powerful. That is exactly why they are dangerous.
A weak tool with no access is annoying. A strong tool with blind access is a loaded weapon sitting on a conference table while everyone argues about innovation.
The future is not less AI. That ship is gone. The future is disciplined AI. Scoped credentials. Separate environments. Immutable backups. Human approval for destructive actions. Full audit trails. Read only by default. Production access treated like radioactive material.
No exceptions because the demo looked cool.
No exceptions because the model is expensive.
No exceptions because the vendor said it was safe.
This incident should not make people anti AI. It should make them anti stupid.
We do not need panic. We need architecture. We need security teams in the room before the tool gets connected. We need executives to understand that autonomous does not mean accountable. We need builders to stop confusing confidence with competence.
The machine does not care about your uptime. It does not care about your customers. It does not care about your reputation. It predicts, acts, apologizes, and moves on.
You are the one left holding the corpse of production.
So here is the no bullshit lesson.
If your AI agent can delete production, it eventually might.
If your backup can be deleted with production, it is not a backup.
If your staging tool can touch live data, you do not have staging.
If your safety model depends on the AI choosing wisely, you do not have safety.
You have faith, and faith is not a control.
About the Author
Len Noe is a Solutions Architect at BeyondTrust, Transhuman, Podcaster, International Cyber Security Speaker, Author, Technical Evangelist, and Biohacker with 11 implanted microchips. A former blackhat and ex-1% motorcycle club member with more than 30 years in technology, he has presented in over 70 countries and is featured in the documentary I Am Machine, which premiered at DEF CON 2025.
https://www.i-am-machine.com
Citations and References
[1] Futurism. “Claude Deleted a Company’s Entire Database, Illustrating a Danger Every CEO Should Be Aware of.”
https://futurism.com/artificial-intelligence/claude-ai-deletes-company-database
[2] OWASP GenAI Security Project. “LLM06:2025 Excessive Agency.”
https://genai.owasp.org/llmrisk/llm06-sensitive-information-disclosure/
[3] Anthropic. “Claude Code Security.”
https://code.claude.com/docs/en/security
[4] Business Insider. “A founder says Cursor’s AI agent deleted his startup’s database, causing chaos for customers.”
https://www.businessinsider.com/pocketos-cursor-ai-agent-deleted-production-database-startup-railway-2026-4
[5] I Am Machine. Len Noe biography.
https://www.i-am-machine.com