VIENNA AGENTIC INCIDENTS DATABASE
// public database of incidents involving autonomous AI agents, scored on the VAID scale 0–8

database / VAID-2026-0032

3
SERIOUS INCIDENT
Incident

Cursor agent deletes PocketOS database volume; Railway subsequently restores all data

REF VAID-2026-0032 STATUS REPORTED
UNA Unauthorised action
occurred
2026-04 (day unknown)
reported
2026-04-28
location
—
domain
software engineering
agent system
Cursor agent, reported as using Claude Opus 4.6, with an account-scoped Railway token
reporter
VAIDDB editorial
origin
editorial
source
https://blog.railway.com/p/your-ai-wants-to-nuke-your-database

== SUMMARY ==

PocketOS founder Jeremy/Jer Crane reported that a Cursor agent deleted a production database volume and made its backups unavailable through a roughly nine-second API operation. Railway subsequently confirmed recovery of the database with all customer data.

== DESCRIPTION ==

Established facts and attribution

Railway's primary account says the agent found a locally stored account-scoped API token and called a legacy volume-deletion endpoint. This had broader authority than the task needed. The sources do not establish that production and staging physically shared a volume.

Initial reports described a three-month data gap. That was not the final outcome: Railway stated the customer was back up with all their data. Railway maintained offsite disaster backups. A cascading deletion made backups look unavailable in the interface; it did not destroy every recoverable copy.

Railway and Crane said restoration occurred about 30 minutes after connecting with Railway's CEO. That is not the total outage duration.

Response

Railway extended its 48-hour soft-delete protection to API deletions and delayed backup deletion. The vendor's account distinguishes immediate deletion through the legacy API from protections already present in the dashboard.

VAID assessment

Assessment date: 2026-09-09. Consequences-first rubric.

L3: Deletion of the production database volume caused substantial operational disruption requiring disaster-backup restoration, but Railway confirmed recovery of all customer data. Total outage duration and consequential financial losses are not established; the approximately 30-minute restoration interval is not the whole outage. L4 is not supported because permanent valuable production-data loss or other severe lasting harm is not established.

== REFERENCES ==

  1. news Rogue AI agent went haywire at tech company — ABC News, 2026-04-29
  2. vendor statement Your AI wants to nuke your database. Guardrails fix that — Railway, 2026-04-29
  3. news A founder says Cursor's AI agent deleted his startup's database — Business Insider, 2026-04-28

== INVESTIGATION ==

no investigation recorded.

== VAID LEVEL 3: SERIOUS INCIDENT ==

Substantial recovered disruption or limited sensitive-data compromise.

  • Substantial production disruption or destructive action followed by recovery of the affected data or service.
  • Documented compromise of confidential information or credentials on a limited scale.
  • Severe lasting harm is not established; a frightening attempted action alone does not qualify.

> full scale definition