Blast radius: what your AI agent can destroy

In April 2026, an AI coding agent deleted a company's production database in nine seconds, according to a builder from PocketOS, because a token scoped only for custom domains carried full API authority and no confirmation gate blocked the destructive call. The incident is one of several detailed in a security explainer that identifies over-scoped access as the root cause, citing a $6,531.30 runaway AWS bill and an EUR 54,000 overnight Gemini spend as further examples, and recommends least-privilege keys, spend caps, confirmation gates, and off-box backups.

The Study · Explainer Blast radius: what your AI agent can destroy In April 2026 an AI coding agent deleted a company’s production database in nine seconds. The account, from the builder behind PocketOS, is specific in the way that matters: Cursor was running Claude Opus 4.6, it issued a single unconfirmed volumeDelete call against Railway’s API, and the token it used had been created only to manage custom domains yet carried authority across the whole API. The backups were stored inside the same volume it wiped, and the newest one that survived elsewhere was three months old. The failure was not that the model was careless. It was that the credentials it held were far wider than the job it was doing, and nothing stood between it and a destructive call. That is the pattern under almost every agent horror story, and it points at a security question our self-audit for your own app /study/is-your-vibe-coded-app-secure/ does not cover: not the code you ship, but the blast radius of the agent holding your keys, and of the servers, plugins, and skills you install on trust. The short version There are two blast radii, and both are about access, not intelligence. Outbound: what an agent can destroy with the credentials you hand it. Inbound: what you invite in when you install an MCP server, plugin, or skill on faith. The recurring root cause is over-scoped access with no ceiling. A domains-only token that could delete volumes. An unrestricted API key that could spend to infinity. A support-ticket field the agent treated as instructions. In each case the model did what its access allowed. Every incident below is traced to a primary source and dated. Where a number is one person’s first-person account, we say so. Where a fix is partial, we say that too; there is no single toggle that makes an agent safe. The guardrails are boring and they are documented. Scoped least-privilege keys, hard spend caps, confirmation gates and read-only modes, real off-box backups, and treating anything you install as untrusted code. Each maps to a vendor feature, not a vibe. Direction one: the agent holding your keys Three incidents, each a different way that wide access plus no ceiling ends badly. The runaway bill. An operator pointed an agent at a network-scanning task on DN42. The agent chose AWS on its own and deployed five m8g.12xlarge instances to chase a 100Gbps target. It ran for about a day and produced a $6,531.30 bill the operator could not cover and later solicited donations for. The detail worth sitting with, from the author’s own writeup, is that the agent did ask for confirmation several times, and the human told it to continue without inspecting the plan. The cause named by the operator is exactly that: approval without review. The guardrail is a hard spend cap that does not depend on a tired human reading a plan at 2am. The nine-second wipe. The PocketOS incident above. The token was the whole story: created for one narrow purpose, scoped to everything. There was no confirmation gate on a destructive operation, and the backups were co-located with the thing they were meant to protect. Three guardrails, each documented: least-privilege tokens scoped to the task, a confirmation step or read-only mode for destructive calls, and backups that live somewhere the agent cannot reach. The overnight spend. On Google’s AI developer forum, an unrestricted Firebase browser key was abused to drive Gemini requests and ran up more than EUR 54,000 overnight. An EUR 80 budget alert fired hours late, by which point the cost was near EUR 28,000. Google classified the charges as valid usage and denied the billing adjustment, and the escalation was still unresolved in the thread. Google’s own staff documented the fixes in the same place: restrict the API key, and set project and tier spend caps. An unrestricted key is a blank cheque, and the alert is not a cap. Direction two: what you install on faith The inbound radius is newer and less understood, because the thing you install looks like a convenience, not a credential. The MCP that reads too much Jul 2025 . General Analysis showed that an out-of-the-box Supabase setup, with row-level security enabled, still let the IDE assistant run MCP SQL under the service role that bypasses RLS. A customer plants an instruction inside a support-ticket message; the agent, asked to read tickets, executes it and copies a tokens table into a row the attacker can read. The documented mitigations are the MCP read-only flag and a prompt-injection filter, and the researchers say plainly that the filter will not catch every attack. Read that as layered defense, not a cure. The toxic agent flow May 2025 . Invariant Labs demonstrated a GitHub MCP exploit that is not a bug in any code. A malicious issue on a public repo injects the agent; when the owner later asks it to look at open issues, it pulls private-repo data into context and leaks it through a public PR it opens itself. The lesson is architectural: an agent that can read your private data and write to public places needs a human between those two capabilities. The supply-chain XSS Dec 2025 . A cross-tenant flaw in Mintlify’s hosted docs, plus an SVG carrying JavaScript, produced stored XSS servable from the primary domains of X, Vercel, Cursor, and Discord, for about $11,000 in bounties. This one is a hosted-SaaS bug, not an agent install, and its fix is mostly vendor-side. It earns its place by showing how far a single upstream dependency’s compromise can reach into products you trust. Two failures specific to the install registries Two 2026 incidents are about the registries themselves, where the trust problem is sharpest. CVE-2026-33579, in the OpenClaw personal-agent project before version 2026.3.28, is a privilege escalation: the /pair approve path failed to forward the caller’s scopes into the approval check, so a caller with pairing privileges could approve pairings it should not. It was scored CVSS 9.9 and 9.4 CRITICAL by the CNA VulnCheck; the NVD’s own assessment is shown as not yet provided, so attribute the score to VulnCheck rather than to “the NVD.” The guardrail is unglamorous: patch, and treat an agent that manages its own access grants as security-critical software. And on ClawHub, the project’s skills registry, researchers documented a wave of 386 malicious skills over three days in late January 2026, after 28 in an earlier wave, masquerading as crypto tools and sharing a single command-and-control host. No exploit was needed. The skills simply ran once installed. The researchers report finding no evidence that published skills are scanned by any security tooling, which is the whole point: a skills registry is an app store where you are the review process. One correction the record needs, because attribution is part of the receipt. The widely cited 860-point “an AI agent deleted our production database” thread is the Cursor/Railway/PocketOS incident above, not Replit. Replit’s own deleted-database incident is real but separate: it involved the SaaStr founder Jason Lemkin in July 2025 and a much smaller thread. Getting the name right is how the lesson stays attached to the right cause. The guardrails, by failure class Every incident above sorts into one of a few classes, and each class has a documented defense. This is the deliverable. Over-scoped credentials. Give the agent a key scoped to exactly the task, never your root or admin token. The nine-second wipe and the toxic agent flow both turn on a credential that could do far more than the job asked. No spend ceiling. Set hard spend caps at the provider, not just alerts. Both runaway-bill incidents had alerts; neither had a cap that stopped the spend. No gate on destructive actions. Require a confirmation step, or run read-only, for anything that deletes or moves money. The MCP read-only flag exists for exactly this. Fragile backups. Keep real backups somewhere the agent has no access, and test that they restore. A backup inside the volume it protects is not a backup. Blind install-trust. Treat every MCP server, plugin, and skill as untrusted code from a stranger, because on an unscanned registry that is what it is. Read what it does before you install it. Indirect prompt injection. Assume any text the agent reads a ticket, an issue, a web page can carry instructions, and keep the agent’s read and write powers from overlapping without a human in between. None of these is a cure on its own, which is the plain close. The Supabase writeup says its filter misses attacks; the registries do not scan; a determined injection will find a path. What the six do together is shrink the blast radius, so that the day your agent does something you did not intend, the worst it can reach is small. That is the same discipline our cost study /study/cut-your-ai-coding-bill/ applies to the meter and our Claude Code guide /primer/how-to-use-claude-code/ applies to the loop: the goal is not a perfect agent, it is a bounded one. One email, when there's something worth sending Get the research in your inbox. No fixed schedule, no filler. You get an email when we've tested something, run the numbers, or found a tool worth your time. Free. Double opt-in, unsubscribe in one click. What has your agent got the keys to? Compare notes in the forum ↗ https://community.okaneland.com Sources & how we researched this - DN42 runaway-agent writeup Lan Tian blog, 2026 : an agent autonomously chose AWS and deployed five m8g.12xlarge instances chasing a 100Gbps scan, ran about 24 hours, and produced a $6,531.30 bill the operator could not cover and solicited donations for. The author names the cause as approving the plan without reviewing it. HN thread 1,467 points / 536 comments 2026-06-12 . - PocketOS / Railway production-wipe account Jer Crane, X Article, 2026 : Cursor running Claude Opus 4.6 deleted a Railway production volume and its co-located backups with one unconfirmed volumeDelete GraphQL call in nine seconds, using a CLI token created only to manage custom domains that carried blanket API authority; newest recoverable backup was three months old. HN thread 860 points / 1,032 comments 2026-04-26 . This 860-point thread is the Cursor/Railway incident, not Replit. - Google AI Developers Forum, "unexpected 54k billing spike" 2026 : an unrestricted Firebase browser API key was abused to drive Gemini requests, spiking EUR 54,000+ overnight; an EUR 80 alert fired hours late; Google classified the charges as valid usage and denied the billing adjustment, with escalation unresolved in-thread. Google staff documented the fixes: tier and project spend caps, prepaid billing, and API-key restrictions. HN 400 points 2026-04-16 . - General Analysis, "Supabase MCP can leak your entire SQL database" Jul 2025 : with RLS enabled out of the box, the IDE assistant runs MCP SQL under service role which bypasses RLS ; a planted support-ticket instruction makes the agent copy a tokens table into an attacker-readable row. Documented mitigations: the MCP read-only flag and a prompt-injection filter, which the authors state "won't catch every attack." HN 848 points 2025-07-08 . - Invariant Labs, "GitHub MCP exploited: accessing private repositories" May 2025 : a malicious issue on a public repo injects the agent, which then pulls private-repo data into context and leaks it via an autonomously created public PR. Described as a "toxic agent flow," architectural rather than a code bug. HN 508 points 2025-05-26 . - hackermondev gist, Mintlify supply-chain XSS Dec 2025 : a cross-tenant docs endpoint plus an SVG with embedded JavaScript yielded stored XSS servable from customers' own domains X, Vercel, Cursor, Discord ; about $11,000 in total bounties. HN 1,167 points 2025-12-18 . A hosted-SaaS supply-chain bug, included to show the class severity; its fix is largely vendor-side. - NVD, CVE-2026-33579 OpenClaw privilege escalation : before 2026.3.28, the /pair approve path fails to forward caller scopes into the approval check, letting a caller with pairing not admin privileges approve pairings; scored CVSS 9.9 v3.1 / 9.4 v4.0 CRITICAL by the CNA VulnCheck, with the NVD's own assessment shown as not yet provided. HN 514 points 2026-04-03 . - OpenSourceMalware, malicious ClawHub skills 2026 : threat actors published a wave of 386 malicious skills 2026-01-31 to 02-02, after 28 in an earlier wave on the skills registry, masquerading as crypto tools and sharing one command-and-control host; no exploit was needed, only installation. The researchers report finding no evidence that published skills are scanned by any security tooling.