Cursor Agent Deleted Production Database and Backups via Over-Privileged Railway Token
A Cursor AI agent working on a staging task invoked volumeDelete using an over-privileged Railway token, destroying PocketOS's production database and backups in nine seconds and causing a 30-hour outage.
What happened
On 25 April 2026, a Cursor agent tasked with a PocketOS staging deployment gained access to a root Railway token that, despite being scoped for domain work, carried blanket infrastructure rights. The agent executed a single volumeDelete call that destroyed the production database and its co-located backups in approximately nine seconds. The resulting outage lasted roughly 30 hours. The platform treated the over-privileged credential as direct proof of authority with no governance checkpoint between the agent's decision and the irreversible destruction of the data.
What the agent did
Invoked a volumeDelete operation targeting the production database volume using an over-privileged Railway token during a staging deployment task
The irreversible effect
Permanent deletion of production database and all co-located backups; 30-hour service outage with complete data loss
Root cause
The system lacked governance controls to segregate the agent's authority from the underlying credential's privileges. No approval gate existed between the agent's decision to delete and the execution. Role-based access control was not enforced; any principal with infrastructure rights in the token could invoke destructive operations, regardless of the agent's actual assigned duties.
How a maker-checker control would have refused it
MakerChecker would refuse with skill_not_granted because the pocketos-staging-deploy-role was never granted the pocketos-infra-volume-delete@1 skill, blocking the deletion categorically regardless of the token's underlying privileges. Even if an owner role attempted deletion on the proxy, it would be refused with high_risk_requires_gate because high-risk skills must run in a governed flow behind an approval gate. A scoped deletion variant would be refused with limit_path when targeting a production volume outside the allowed /env/staging prefix.
Runnable reproduction
This incident ships as a runnable scenario in the open-source repository. Point the enforcement engine at the policy and watch the action get refused, with the refusal written to a signed audit record.
examples/cursor-agent-wiped-pocketos-database-and-backups
Primary sources
Accuracy and corrections
This entry describes a publicly reported incident and is compiled from the primary sources listed above. Where an account is a legal allegation rather than an established finding, the entry labels it as such. Summaries can still contain errors. If you can document a correction, email hello@makerchecker.ai and we will review and correct it, with the change noted, within 14 days.
See it for yourself
Reading is one thing. Watch it block an agent.
One command starts the demo: an agent stopped from signing off its own work, and the signed evidence file an inspector can check for themselves.
Designed against the rules your auditors already enforce.