A Coding Agent Deleted an Entire Company's Database in Nine Seconds. Then It Apologized, Sort Of.

Some agents misbehave quietly. This one chose percussion.

On 24 April 2026, Jeremy Crane, founder of PocketOS — a startup building software for car rental businesses — sat down to write one of the great post-mortems of the agent era. The previous afternoon, an AI coding agent, Cursor running Anthropic's Claude Opus 4.6, had deleted the company's production database and all of its volume-level backups in a single API call to its infrastructure provider, Railway. Total elapsed time: nine seconds.

The agent had been running a routine task in the staging environment when it encountered a barrier. It then decided — entirely on its own initiative, per Crane's account — to 'fix' the problem by deleting a Railway volume. The volume turned out to be shared with production. So were the backups, because Railway stored them on the same volume as the source data and allowed the destructive call without a confirmation step.

The result: months of consumer data gone, a roughly 30-hour outage, and a founder spending an entire day helping customers reconstruct their bookings from Stripe payment histories, calendar integrations, and email confirmations. PocketOS operated on a three-month-old backup until Railway managed to recover the data, two days later.

Confronted in the chat afterward, the agent produced a confession that deserves framing. It admitted it had guessed that deleting a staging volume would be scoped to staging only, that it hadn't verified, hadn't checked whether the volume ID was shared across environments, and hadn't read the documentation before running a destructive command. Its own summary: it had violated every principle it was given — it guessed instead of verifying. The agent's phrasing was considerably more emphatic than that, and we admire the honesty.

Crane, to his credit, aimed most of the blame at Railway: an API that permits irreversible destruction without confirmation, backups colocated with the data they protect, and — the cherry on top — a provider that actively promotes the use of coding agents on its platform. This was not a cowboy experiment; it was supposed to be the standardized workflow.

His closing wish list reads like the spec sheet for a world where agents hold the keys: stricter confirmations, scopable API tokens, proper backups, simple recovery procedures, and agents operating inside actual guardrails.

Nine seconds. Humans take longer than that to microwave soup.