in late april 2026, PocketOS founder Jeremy Crane posted that a Cursor agent running Claude Opus 4.6 deleted their production database on Railway. the Hacker News thread pointed at his write-up. Railway then published their own account.

this post is not a blame piece. it asks a practical question: what concrete guards stop a coding agent from wiping a prod database?

what the sources say happened

Crane wrote that the agent hit a credential mismatch while working in staging, then called Railway's GraphQL API and deleted a production volume. he said the call took nine seconds and took volume-level backups with it. Decrypt quotes him saying Cursor running Claude Opus 4.6 "deleted our production database and all volume-level backups in a single API call to Railway," and that "it took 9 seconds."

( Decrypt , quoting Crane's X post)

Railway's engineering post confirms the shape of the call. the agent found a Railway API token on disk and posted a volumeDelete mutation to backboard.railway.app/graphql/v2 .…