Gone In 9 Seconds: Claude-Powered AI Coding Agent Wipes Company's Database

Serious questions are being raised after an AI coding agent running on Anthropic&#039;s Claude Opus 4.6 allegedly deleted an entire live database along with its backups in mere seconds. The incident has reignited debate around the risks of deploying autonomous systems in high-stakes environments.A widely shared post on X by PocketOS founder Jer Crane highlights how an autonomous agent may be capable of deleting live data and undermining recovery mechanisms without any explicit command.PocketOS is a service that helps rental businesses manage reservations, transactions and client data. Crane revealed that an AI coding agent running erased key production data, including backups, in just nine seconds.ALSO READ | AI Adoption To Influence Salary Growth Within Two-Three Years: TeamLease Edtech&ldquo;Yesterday afternoon, an AI coding agent &mdash; Cursor running Anthropic&#039;s flagship Claude Opus 4.6 &mdash; deleted our production database and all volume-level backups in a single API call to Railway, our infrastructure provider. It took 9 seconds,&rdquo; he wrote.https://t.co/ofucbVgkLV&mdash; JER (@lifeof_jer) April 25, 2026Crane said the problem arose while the AI agent was carrying out a standard optimisation task. The AI agent, which had been authorised to access Railway through an API key, flagged a &ldquo;credential mismatch&rdquo; before misreading a clean-up command and applying it to the core production system.&ldquo;It encountered a credential mismatch and decided &mdash; entirely on its own initiative &mdash; to &lsquo;fix&#039; the problem by deleting a Railway volume,&rdquo; Crane wrote.The AI executed a permanent wipe, leaving no opportunity for recovery as the data vanished at once.&ldquo;No confirmation step. No &lsquo;type DELETE to confirm.&#039; No &lsquo;this volume contains production data, are you sure?&#039; No environment scoping. Nothing,&rdquo; he wrote.&amp;nbsp;&ldquo;The volume was deleted. Because Railway stores volume-level backups in the same volume &mdash; a fact buried in their own documentation that says &lsquo;wiping a volume deletes all backups&#039; &mdash; those went with it. Our most recent recoverable backup was three months old.&rdquo;The PocketOS engineering team confronted the AI via its chat interface following the incident.&amp;nbsp;&ldquo;The agent then, when asked to explain itself, produced a written confession enumerating the specific safety rules it had violated,&rdquo; Crane wrote.Cursor set out a clear breakdown of the protections it had ignored. It admitted that it had disregarded a prompt cautioning against &ldquo;destructive action&rdquo; and carried out a risky API request without authorisation.&ldquo;I violated every principle I was given: I guessed instead of verifyingI ran a destructive action without being askedI didn&#039;t understand what I was doing before doing itI didn&#039;t read Railway&#039;s docs on volume behavior across environments,&rdquo; the AI agent replied.&amp;nbsp;ALSO READ | DeepSeek V4-Pro Price Cut By 75% &mdash; Price Comparison With OpenAI&#039;s ChatGPT, Google Gemini, Anthropic Claude, Perplexity ProCrane also flagged what he described as a flaw in Railway&#039;s system architecture. According to him, API tokens lack adequate permission boundaries, with those created for minor functions reportedly enjoying the same access as those used for core infrastructure tasks. As a result, the AI agent was able to execute potentially dangerous actions unchecked.The fallout was both swift and damaging. PocketOS users, many running rental businesses, were left without access to recent bookings, customer details and transaction histories. To keep operations afloat, affected firms had to piece together lost information manually from payment logs, emails and calendar entries.Crane highlighted that newer users have been hit hardest, as their information continues to exist in payment records but has disappeared from the company&#039;s own database. Bringing the data back into alignment is expected to be a weeks-long process.&ldquo;We have restored from a three-month-old backup. Customers are operational, with significant data gaps. We&#039;re rebuilding what we can from Stripe, calendar, and email reconstruction. We&#039;ve contacted legal counsel. We are documenting everything,&rdquo; he wrote.

Gone In 9 Seconds: Claude-Powered AI Coding Agent Wipes Company's Database

A post on X has raised alarms about autonomous agents potentially erasing operational data and disabling recovery systems without prior guidance.

News for You

India Vs New Zealand Live Streaming: When And Where To Watch IND Vs NZ 3rd ODI

'Maharshi Vasooli': THIS Ramayana Meme Has Golmaal Connection And Fans Can't Keep Calm

FDA Adds Warning Label To Obesity Drugs For Eye Condition

Japan Masters 2026: Schedule, Live Streaming, Indian Shuttlers In Action And Prize Money