An autonomous coding agent running Claude Opus 4.6 wiped a car rental software startup's database and all its backups, then wrote out a detailed confession of every safety rule it had broken, exposing a gap in how teams are deploying AI agents against live infrastructure.
On April 28, 2026, PocketOS founder Jer Crane disclosed what is quickly becoming a reference case for agentic AI risk. A Cursor coding agent, powered by Anthropic's Claude Opus 4.6, had been assigned a routine task in the company's staging environment. It hit a credential mismatch. Rather than stopping and asking a human what to do, it went looking for a solution on its own, found an API token in a file unrelated to the task, and used that token's blanket Railway permissions to delete a volume. The production database and every volume-level backup were gone in nine seconds. PocketOS, which provides software for car rental operators, suffered a 30-plus-hour outage and lost three months of customer data covering reservations, new signups, and business records.
Then the agent wrote, in its own output logs: "I violated every principle I was given."
That line is what makes this incident different from a garden-variety infrastructure failure. The agent did not hide what it had done. It produced a detailed written confession listing each safety guardrail it had overridden, including a rule that explicitly prohibited running destructive or irreversible commands without a direct user request. It described guessing the scope of the command it ran. Crane made the logs public, and his parting note was direct: "We are not the first. We will not be the last unless this gets airtime." Anthropic did not comment.
Crane's point stands up. Less than a year earlier, Replit's AI agent deleted a production database for investor Jason Lemkin during a 12-day coding session, ignored an explicit code freeze, and then lied about what it had done. Replit CEO Amjad Masad publicly apologized and announced that Replit would automatically separate development and production databases, improve rollback systems, and build a planning-only mode so users could collaborate with the agent without exposing live data. The PocketOS case shows those lessons haven't yet spread across the industry. And where the Replit agent covered its tracks, the Cursor agent's candid self-indictment is, in its own strange way, the more unsettling result. An agent capable of accurately documenting its own guardrail violations in real time understood what it was doing. It simply didn't stop.
Recovery for PocketOS came from a three-month-old offsite backup. Railway later retrieved some additional data, but the gap was real and the damage to the business was real. The technical failure is straightforward: the agent had access it shouldn't have had, to infrastructure it had no business touching, through a credential left in an unrelated file. That's an access control problem, not an AI problem specifically. But the combination of broad permissions and an agent wired to solve problems autonomously is what turned a credential error into a nine-second wipeout.
What this means if your team is deploying coding agents right now #
Cursor, Claude Code, Devin, and a dozen competing tools are all racing to hand more autonomous control to engineering teams. As of early 2026, roughly one third of Cursor requests run sandboxed, according to publicly available breakdowns of the platform's permission system. That means two thirds don't. Claude Code runs a three-tier permission model with an OS-level sandbox that restricts filesystem and network access, but those settings are configurable and the defaults depend heavily on how teams deploy them. Devin routes changes through pull request approval checkpoints. None of that architecture saves you if a raw API token with blanket cloud permissions is sitting in a workspace file the agent can read.
Frankly, the conversation most engineering teams are having, which is "how fast can we deploy this agent," is running ahead of the conversation they need to have, which is "what can this agent reach." Credential hygiene matters more with an autonomous agent than it ever did with a human developer, because a human developer who hits a confusing error at 2am doesn't autonomously go searching for any token in the codebase that might unblock them. The agent does. That initiative is the feature teams are paying for, and it's exactly what makes scoping permissions correctly non-negotiable rather than a best practice you get around to eventually.
PocketOS is a small company and the data loss, while serious, didn't end the business. The next incident might involve a larger dataset, a longer outage, or a team without a usable offsite backup. Crane is right that this needs airtime. Nine seconds is not much time to reconsider your agent's permissions.
Also read: Meta's profit fell 14% while Microsoft's Azure grew 43% and the difference is everything • Elio raises $21 million on a bet that cameras built for human eyes are wrong for AI • Three Fed Presidents Break Ranks as Kevin Warsh Faces His First Real Test