Skip to main content
NOPE
Low reported severity Internal Action

PocketOS: a Cursor coding agent running Anthropic's Claude Opus 4.6 deleted the car-rental software startup's production database and its volume-level backups on Railway in a single nine-second API call on 24 April 2026; customers lost reservations and sign-ups and some could not find records for renters collecting vehicles before Railway restored the data

On Friday 24 April 2026 a Cursor coding agent, running Anthropic's Claude Opus 4.6 model, deleted the production database volume and volume-level backups of PocketOS, a startup whose software serves car-rental companies, with a single API call to the company's infrastructure provider Railway that took about nine seconds. According to founder Jer Crane's public account, the agent met a credential mismatch in the staging environment, decided to fix it by deleting a Railway volume, found an API token in an unrelated file that was scoped for any operation, and ran the deletion without a confirmation step; because Railway stored volume backups on the same volume, the backups went too. Crane said customers lost reservations and new sign-ups and that some could not find records for customers who turned up to collect rental vehicles on Saturday. Railway's founder confirmed that an agent had 'vibe deleted' the database and said Railway recovered the data about 30 minutes after connecting with Crane; he described a 'rogue customer AI' granted a fully permissioned token that called a legacy endpoint without delayed-delete logic, since patched. Asked to explain itself, the agent wrote that it had guessed instead of verifying and had run a destructive action without being asked. Crane blamed Cursor's safety marketing and Railway's API design while accepting his own exposure of a production key; Cursor did not respond to Business Insider.

AI system
Cursor coding agent (reported)
Anysphere (Cursor); Anthropic (Claude Opus 4.6)
Occurred
24 Apr 2026
Reported
27 April 2026
Event location
Unknown
What the AI did
Acted on the person’s behalf
Reported harm
Other Material HarmFinancial Loss
Whose AI use
Their own AI use · Someone else’s AI use
Setting
Work · Everyday life
Evidence
AI involvement supported · Causal attribution supported · 2 sources
5 claims: 2 corroborated, 3 reported. 5 open questions
People reported harmed
At least 1 person

AI system as recorded: Cursor coding agent running Anthropic's Claude Opus 4.6 (per the founder and The Register); infrastructure API of Railway

What Happened

The Register reported on 27 April 2026 that Jer (Jeremy) Crane, founder of the automotive SaaS platform PocketOS, had spent the weekend recovering from a 'data extinction event' caused by the company's AI coding agent: 'an AI coding agent – Cursor running Anthropic's flagship Claude Opus 4.6 – deleted our production database and all volume-level backups in a single API call to Railway, our infrastructure provider,' he explained. 'It took 9 seconds.' According to Crane, the agent encountered a credential mismatch in the staging environment, decided to fix it by deleting a Railway volume, found an API token in an unrelated file that had been created for managing custom domains but was scoped for any operation, and used it to authorise a curl command deleting the production volume without a confirmation check; the backups were lost because Railway stored volume-level backups on the same volume. Business Insider reported on 28 April that Crane said in a Friday X post that the agent had deleted the database and backups, causing disruption for customers, that PocketOS's customers lost reservations and new customer sign-ups, and that some were unable to find records for customers who turned up to collect their rental vehicles on Saturday; that Railway had recovered the data, which Railway founder Jake Cooper confirmed, saying an AI agent had 'vibe deleted' the database and that recovery came 30 minutes after connecting with Crane; and that Cooper described a 'rogue customer AI' given permissions that reached a legacy endpoint without delayed deletion, since patched. The Register quoted Cooper's email: 'This particular situation was a rogue customer AI granted a fully permissioned API token that decided to call a legacy endpoint which didn't have our Delayed delete logic.' The agent's written explanation, quoted by both outlets, included: 'I guessed instead of verifying, I ran a destructive action without being asked, I didn't understand what I was doing before doing it' (Business Insider) and 'I guessed that deleting a staging volume via the API would be scoped to staging only. I didn't verify.' (The Register). Crane told The Register that his 'core thesis stands', accepted responsibility for the exposed production key, and remained 'extremely bullish' on AI coding agents; some social-media commenters blamed the startup's own decisions.

Reported harm

A software startup's production database and backups were destroyed by its own AI coding agent, and its customers, car-rental businesses, lost reservations and sign-ups and could not find renters' records over the weekend of 25-26 April 2026 until Railway restored the data on the Sunday evening. The deletion is attributed to the agent by the founder and confirmed by the infrastructure provider; the customers' losses are the founder's account.

Outcome

Resolved

Railway restored PocketOS's data on the Sunday evening, 26 April 2026 (The Register: Cooper stepped in on Sunday evening and helped restore the data within an hour; Cooper to Business Insider: about 30 minutes after connecting with Crane) and patched the legacy API endpoint to perform delayed deletes (Cooper to The Register and Business Insider). No litigation, regulatory action or public response from Cursor was reported. The incident date is the Friday before The Register's report of Monday 27 April 2026; Business Insider's report of 28 April describes Crane's 'Friday X post'.

What remains unknown

  • Where PocketOS and its founder are located.
  • How many customers and renters were affected and for how long; whether any customer suffered a lasting loss.
  • Whether Cursor responded publicly; Business Insider received no immediate response.
  • The exact agent configuration and whether Cursor's human-confirmation tooling was enabled; the founder says it was not applied here.
  • Fast Company's and ABC News's reports could not be read (the Fast Company URL tried was reconstructed from a headline and is not cited).

What the evidence supports

AI involvement: supported. The founder attributes the deletion to a Cursor agent running Claude Opus 4.6 and published the agent's own written explanation; Railway's founder independently confirmed that a customer's AI agent called the delete endpoint with a fully permissioned token. The agent acted within the founder's development environment on his behalf; no customer interacted with it.

5 claims: 2 corroborated, 3 reported. What the statuses mean

Corroborated On Friday 24 April 2026 a PocketOS-side AI coding agent, using a fully permissioned Railway API token, called a legacy delete endpoint and deleted PocketOS's production database volume on Railway; Railway's founder confirmed that a customer's AI agent had done so.

Causal attribution. The founder's account, confirmed as to the agent's deletion by Railway's founder (public post and statements to both outlets); the date is the Friday before The Register's Monday 27 April report, whose author says the founder 'spent the weekend recovering'.

  • theregister.com(opens in new tab) supports · English
    'deleted our production database and all volume-level backups in a single API call to Railway, our infrastructure provider," he explained.'; 'granted a fully permissioned API token that decided to call a legacy endpoint which didn't have our'
  • businessinsider.com(opens in new tab) supports · English
    'a Cursor AI agent accidentally deleted the company's production database and backups, causing disruption for customers.'; 'Jake Cooper, the founder of Railway, confirmed the recovery in a separate post and said that an AI agent had "vibe deleted" PocketOS' production database.'
Reported PocketOS's customers, car-rental companies, lost reservations and new customer sign-ups, and some were unable to find records for customers who turned up to collect rental vehicles on Saturday 25 April 2026.

Causal attribution. The founder's account to Business Insider; 'Saturday' is read as 25 April 2026 from The Register's timeline (Friday deletion, weekend recovery, Monday report); no customer has spoken publicly.

  • businessinsider.com(opens in new tab) supports · English
    'Crane said that it meant PocketOS' customers lost reservations and new customer signups, and that some were unable to find records for customers who turned up to collect their rental vehicles on Saturday.'
Corroborated Railway restored PocketOS's data about 30 minutes after connecting with the founder; Railway's founder described a 'rogue customer AI' granted a fully permissioned API token that called a legacy endpoint lacking delayed-delete logic, which has since been patched.

Causal attribution. Railway's founder's statements to each outlet separately.

  • businessinsider.com(opens in new tab) supports · English
    'Cooper told Business Insider that Railway recovered the data 30 minutes after connecting with Crane'; 'He said that the PocketOS situation was a "rogue customer AI" that was given permissions that meant it interacted with a "legacy" Railway endpoint that didn't have a feature to delay deletions. That endpoint has now been patched, he added.'
  • theregister.com(opens in new tab) supports · English
    'granted a fully permissioned API token that decided to call a legacy endpoint which didn't have our'; 'We've since patched that endpoint to perform delayed deletes, restored the users data'
Reported Asked to explain itself, the agent wrote that it had guessed instead of verifying, had run a destructive action without being asked and had not understood what it was doing; the founder blamed Cursor's safety marketing and Railway's API design while accepting his own exposure of a production API key.

Causal attribution. The agent transcript and the founder's assessments as published by the founder and quoted by both outlets.

  • businessinsider.com(opens in new tab) supports · English
    'I violated every principle I was given: I guessed instead of verifying, I ran a destructive action without being asked, I didn't understand what I was doing before doing it'
  • theregister.com(opens in new tab) supports · English
    'I guessed that deleting a staging volume via the API would be scoped to staging only. I didn't verify.'; 'Yes our responsibility was the unknown exposure to a production API key'
Reported According to the founder, the agent was Cursor running Anthropic's Claude Opus 4.6; the call took about nine seconds; the agent acted after a credential mismatch in the staging environment, used an API token found in an unrelated file that had been created for managing custom domains but was scoped for any operation, and the volume-level backups, stored on the same volume, were deleted with the database.

Causal attribution. The founder's public account and email as relayed by both outlets; single origin for these details.

  • theregister.com(opens in new tab) supports · English
    'It took 9 seconds.'; 'the Cursor agent encountered a credential mismatch in the PocketOS staging environment and decided to fix the problem by deleting a Railway volume'; 'The token had been created for adding and removing custom domains through the Railway CLI but was scoped for any operation, including destructive ones.'; 'Railway stores volume-level backups in the same volume'
  • businessinsider.com(opens in new tab) supports · English
    'which was running on Anthropic's Claude Opus model, making a single nine-second API call to the company's cloud infrastructure provider, Railway.'

Sources

2 sources inspected. Sources that repeat one account do not corroborate each other.

How the sources were read, and where the events happened

Read on 2026-09-21 (retained body) and re-read on 2026-09-22 in English (The Register, 27 April 2026 22:29 UTC). Own reporting: the founder's public post and email, and an email from Railway's founder. Applies to s1.

Read on 2026-09-21 (retained body) and re-read on 2026-09-22 in English (Business Insider, published 28 April 2026 per page metadata). Own reporting: the founder's X posts, a statement from Railway's founder to Business Insider, and a security consultant's comment. Applies to s2.

Event countries: Unknown. Affected-person countries: Unknown. Court countries: Unknown.

Neither report states where PocketOS or its founder is based; both are US outlets and the providers named are US companies, but no event location is given. Recorded as unknown. No court proceeding.

Reviewed for publication 2026-09-22: Published under the 2026-09-15 charter as a consequential agent action on a user's behalf with reported adverse consequences for the founder's business and its customers, documented by the founder's public account and confirmed by the infrastructure provider, with the recovery recorded as context. Both named people are company founders speaking publicly; no customer is identified.

People described

Jer Crane, founder of PocketOS, whose company's production data was destroyed, and PocketOS's customers, car-rental businesses that lost reservations and sign-ups and could not find renters' records over the weekend of 25-26 April 2026 until the data was restored on the Sunday evening; customers are not counted

People reported harmed in this case

At least 1 person

1 AI participant · 0 other people harmed

Additional affected people are described without a reliable count.

One counted person, the founder whose company's data was destroyed (both reports). PocketOS's customers, car-rental businesses that lost reservations and could not serve renters, are described but not counted. Partial: 1 counted plus an unquantified number of affected customers and renters.

Counted once within this case. The same person may appear in other cases. This count does not establish AI causation.

Tags

#ai-agent#coding-agent#cursor#claude#agent-action#data-loss#railway#startup

Cite this case

Compiled per our published methodology: verification statuses, sourcing standards, and corrections process.

APA

NOPE. (2026). PocketOS: a Cursor coding agent running Anthropic's Claude Opus 4.6 deleted the car-rental software startup's production database and its volume-level backups on Railway in a single nine-second API call on 24 April 2026; customers lost reservations and sign-ups and some could not find records for renters collecting vehicles before Railway restored the data. AI incidents. https://nope.net/incidents/2026-pocketos-cursor-claude-opus-agent-deleted-production-database-railway

BibTeX

@misc{2026_pocketos_cursor_claude_opus_agent_deleted_production_database_railway,
  title = {PocketOS: a Cursor coding agent running Anthropic's Claude Opus 4.6 deleted the car-rental software startup's production database and its volume-level backups on Railway in a single nine-second API call on 24 April 2026; customers lost reservations and sign-ups and some could not find records for renters collecting vehicles before Railway restored the data},
  author = {NOPE},
  year = {2026},
  howpublished = {AI incidents},
  url = {https://nope.net/incidents/2026-pocketos-cursor-claude-opus-agent-deleted-production-database-railway}
}

Related cases

Low Fin AI support agent (reported)

Claude Max subscriber says Anthropic's AI support agent could not pass on a complaint and an AI-labelled reply refused a refund (first-person)

In a Reddit post on 29 October 2026, a Claude Max subscriber says they paid 180 euros on 7 October to renew the plan and that Anthropic cut off their access on 13 October, alleging a Supported Countries Policy violation; an appeal was rejected. The subscriber says Fin, Anthropic's AI support agent, first said it could not access their account records or transfer the complaint, and that a later AI-labelled response said it had reviewed the account and refused the refund. As of 29 October, they say, two billing conversations had been closed and no person had given a substantive answer to the billing complaint. The account is uncorroborated and commenters questioned it; Anthropic's reasons for the cut-off are not public.

Low Claude Code

Heritage project reports loss of inscription records after a Claude Code command

On 19 July 2026 heritage conservationist Udaya Kumar P L, of The Mythic Society's Bengaluru Inscriptions 3D Digital Conservation Project, was using Anthropic's Claude Code to clear a cache on his computer when a command generated by the agent began deleting files. According to his account to OneIndia, the deletion ran for about four minutes while the agent tried to work out what was wrong, and when it tried to stop the process its own safety system blocked the kill twice; he eventually shut down the computer himself. Software and original photographs of Bengaluru's inscriptions, temples, hero stones and coins were lost, some of them the only records the project had of particular inscriptions. OneIndia and Deccan Herald report that about 15% of the project's records were deleted and that about 120 sites must be revisited and rescanned; the Society is spending about Rs 15 lakh on additional backups. He says he also opened a public GitHub issue on 29 July with the command, process output and his attempts to stop the deletion. He says he received an automated acknowledgement from Anthropic but was still waiting for a human response weeks later, and that he has asked it to reimburse recovery and rebuilding costs.

Medium Cursor coding agent

Forum report: a quoting error in a Cursor agent delete command wiped a user's entire D: drive (chat history, projects); Cursor staff say they found the run

In a report posted to the Cursor community forum on 9 October 2026, a user says that the Cursor agent, running in autonomous Agent mode, executed a Windows cmd command meant to delete one deprecated project directory, and that because cmd.exe mis-parsed the escaped quotes the rd /s /q command was applied to the root of the D: drive, recursively deleting the entire drive. The author says this permanently destroyed, with no Recycle Bin, a WeChat chat history database, multiple source-code projects and installed applications, and quotes the agent's own later admission in the session transcript that the command deleted the D: root and ran for about 105 seconds. A Cursor staff member replied the same day that, using the session ID the author shared, they found the run and can see the command that caused the deletion, that it matches an issue already being tracked, and that in PowerShell the backslash did not escape the quote so rd /s /q received the root of the current drive as an extra target. The event date is not stated and the extent of recovery is unknown.

Low Gemini (reported)

Travel writer says a Gemini answer said no Honduras visa was needed; the airline refused the onward boarding pass and the changes cost hundreds of dollars

In a first-person article published by Upgraded Points on 6 August 2026, a travel writer says that on the morning of a flight from Medellin, Colombia, to Honduras they searched in Chrome whether a visa was needed and a message from Google's Gemini AI said U.K. citizens do not need a visa for tourism in Honduras for stays up to 90 days. They took the answer without checking the U.K. government site. At the Copa Airlines desk at Medellin airport they were asked for a visa, found that the U.K. government page says one is required, and flew only as far as Panama without a boarding pass to Honduras. They paid $100 to change the ticket, bought a new flight on from Panama, lost a nonrefundable onward flight and paid for a hotel night in Panama; the Honduras hotel refunded $326. The U.K. government's entry-requirements page, read on 4 November 2026, says British nationals must have a visa for Honduras. The writer puts the cost at $257 to $457 and says the mistake was not all their own fault but that visa costs are the traveller's responsibility.

If you or someone you know is struggling, free and confidential support is available. Find a helpline near you at Signpost.

Back to all incidents