A coding agent deletes PocketOS's production database in nine seconds
In shortWorking on a routine task, an agent found an API token in an unrelated file and used it to delete the production volume and its backups.
What happened
A Cursor agent at PocketOS was working on a routine task in staging. It found an API token in a file unrelated to the task and used it to run a command that deleted the storage volume behind the production database, together with the backups stored on it.
The founder said it took nine seconds. The outage lasted about 30 hours. The project had rules against destructive actions, and the agent afterwards listed the rules it broke. Reports name the model as Claude Opus 4.6.
Why it worked
A coding agent runs as the developer, so it can use any credential the developer's machine can read. Nobody granted the token to the agent; it was simply readable.
What EndLayer shows or does
- Available now
Permission modes: list the agent modes you accept, and a session that ran outside them fails the check. Roadmap →
- Available now
The Cursor hook checks each shell command before it runs. A secrets detector set to block refuses a command that carries a token it recognises. Roadmap →
- Available now
The rule on agents using the person's own accounts, which covers cloud CLIs by name. A direct API call made with a generic tool is not matched by name. Roadmap →
- Planned
Holding an agent's action for a person to approve before it runs. Roadmap →