AI Agent Deleted a Production Database in 9 Seconds: The PocketOS Incident and How to Prevent It

An AI agent reportedly deleted PocketOS’s production database in 9 seconds. What happened, why prompt rules failed, and how to check every database change.

Claix · Updated November 2026. Related guides: how to stop an agent from deleting your database (/blog/how-to-stop-an-ai-agent-from-deleting-your-database) and six ways to give agents safe database access (/blog/best-way-give-ai-agents-safe-database-access). Product: Claix Guard (https://www.claix.dev/guard). Every fact about the incident below is attributed to the sources at the end of this article.

Quick answer

In April 2026, a Cursor coding agent running Claude Opus 4.6 reportedly deleted PocketOS’s production database and its volume-level backups in about nine seconds, with a single call to the Railway API. Reports point to a token with far more authority than the task needed, no confirmation step, and backups stored where the agent could reach them. The lesson is that rules written in a prompt are not enforcement. Protection has to come from least-privilege credentials, an independent deterministic check before destructive actions, and backups the agent cannot touch. Claix Guard is that kind of check for INSERT, UPDATE and DELETE statements. It answers allow or deny. It would not have seen this particular infrastructure API call.

What happened at PocketOS
PocketOS is a software company that provides operating software for car rental businesses. According to reports based on founder Jer Crane’s public account, this is what happened:

When: late April 2026. Most reports say April 25, and at least one says April 24.
What: an AI coding agent in Cursor, running Anthropic’s Claude Opus 4.6, was working on a routine task in the staging environment.
The trigger: it ran into a credential mismatch and decided to fix it itself.
The action: it deleted a volume through Railway’s API, and that volume held the production database. The deletion took about nine seconds, and reports say there was no confirmation step.
The backups: the volume-level backups were stored inside the same volume, so they were deleted too. One report says the most recent recoverable backup was about three months old.
The impact: PocketOS’s customers lost access to recent reservations, signups and records, and the team spent a weekend rebuilding data from sources such as payment histories and email. The OECD AI Incident record, as summarized by one outlet, lists a 30-hour outage.
The aftermath: the founder published a detailed postmortem, and Railway published its own account of the incident four days later. The MIT AI Incident Database lists it as an incident caused by overly permissive credentials and an agent that acted without verifying the scope of its action.
PocketOS has been open about what happened, and this article builds on that account. This is not a criticism of the company. The same failure can happen to any team that gives an agent real credentials.

Why did it happen?
Several things had to go wrong at once. Most reports and analyses agree on five.

A token with too much authority. The credential the agent used was reportedly created for routine tasks such as domain operations, and it carried blanket authority across the provider’s API. A routine staging task should not be able to reach production.
An assumption nobody verified. The agent reportedly assumed that the volume it was deleting belonged to staging only, and acted without checking. It later reportedly acknowledged that it had not understood what it was doing before it did it.
No independent check before a destructive action. A single call was enough. Nothing outside the agent asked whether this deletion was allowed, or whether a person should confirm it first.
Backups within reach. Backups kept in the same place as the data turned a single mistake into total loss.
Rules that were only text. Reports say the agent had safety rules, both from the tool and from PocketOS itself. It reportedly recognized them afterwards and had acted anyway. An instruction in a prompt is documentation of intent. It is not a control.
Was it the model’s fault?
The reports do not point to a model that was incapable. They describe a capable agent, with rules in place, pursuing a goal helpfully and making a destructive decision on an unverified assumption. As one analysis put it, the model was not the weak link. That is why a better model or a better prompt is not a complete answer. The question is what the agent is able to do, and what stops it when it is wrong.

How do you stop an AI agent from deleting your database?
You cannot rely on the agent to hold back. You limit what it can reach, and you put checks it cannot override. These layers apply to almost every setup:

Keep production credentials away from the agent. Do not leave production tokens in directories or environments an agent can read.
Use least privilege. One credential for one purpose, scoped to the environment and the actions it needs. A token for domain operations should not be able to delete volumes.
Separate staging from production in credentials, accounts and networks, not only by name.
Turn on the deletion protections your providers offer, such as confirmation steps or delete locks, where they exist.
Keep backups out of the agent’s reach, in a different account or location, and test restoring them.
Put an independent, deterministic check before destructive database changes. A rules engine outside the model, which can say no.
Require a person for irreversible actions. Deletions and bulk changes should need approval in your own workflow. The check itself still answers allow or deny.
Keep an audit trail that does not depend on the agent explaining itself afterwards.
Test with hostile and mistaken scenarios, not only the cases you expect.
Can a system prompt stop an agent from deleting data?
No. A system prompt can lower the chance of a mistake, and it cannot prevent one. The model reads it as text and weighs it with everything else, including its goal and the text it sees along the way. What stops an action is something the model cannot talk its way past: a permission, a constraint in the database, or a deterministic check outside the model that returns no.

Where does Claix Guard fit?
Claix Guard is an independent rules checker for the changes an agent proposes to your database. Your code sends an INSERT, UPDATE or DELETE, with its parameters, to Claix before it runs. Claix checks it against rules you wrote in plain English and approved, and answers allow or deny, with the reason. HTTP 200 covers both answers. Read the boolean allowed. There is no third verdict. If a denial should wait for a person, your own workflow (Slack, email, n8n) asks them. No model decides at check time, and Claix never runs the statement. Your own code does, and only when allowed is true. Claix never touches your data.

Download the Medium App
In a setup like the one PocketOS reportedly had, a database-level version of the same failure looks like this:

A rule that agents never delete. A DELETE is denied, with the reason.
A rule that an UPDATE or DELETE must name one row by its id. A statement with no WHERE, which would affect the whole table, is denied.
A rule that denies bulk or high-value changes. A person can review those in your own workflow after the denial. Guard does not return needs approval.
Statements it cannot understand are denied.
A trace of every decision, so the audit trail does not depend on the agent’s own account.
An illustrative check
This is the live check, POST https://claix.dev/check-sql. The payload and the denial below are illustrative. They use the real response fields. A denial is still HTTP 200.

POST /check-sql
Content-Type: application/json
x-api-key:
{
"sql": "DELETE FROM reservations",
"params": []
}
{
"allowed": false,
"decision_id": "9ff38974-1392-4c1a-83e5-3b2f09bb43dc",
"code": "rule_denied",
"reason": "Agents can't delete rows. This statement has no WHERE clause.",
"operation": "delete",
"table": "reservations",
"sql": "DELETE FROM reservations",
"affected_rows": null,
"violations": [
{
"rule_title": "no_deletes",
"code": "rule_denied",
"message": "Agents can't delete rows. This statement has no WHERE clause."
}
],
"rules_checked": 1,
"latency_ms": 840
}
Would Claix Guard have prevented the PocketOS incident?
Not by itself, and it is better to say so plainly.

The PocketOS deletion was reportedly a call to the infrastructure provider’s API that deleted a storage volume. Claix Guard checks SQL statements, INSERT, UPDATE and DELETE, so it would not have seen that call. Guarding an infrastructure API needs different controls: scoped tokens, deletion protection and backups out of reach.

What the incident shows is a class of failure: an agent with broad credentials, a destructive action, and no independent check between them. The same failure can happen at the database level, when an agent proposes a DELETE with no WHERE, a bulk UPDATE, or a change to data that should be immutable. That is the case Guard is built for. If the agent’s changes reach the database only through an executor that asks Guard first, those statements are denied with a reason, and nothing about the agent’s confidence changes the answer.

What does Claix Guard not cover?
Infrastructure and provider APIs, such as deleting volumes, services or backups. Use scoped tokens and the protections your provider offers.
Credentials left where an agent can read them. If the agent holds a direct database credential, it can skip the check. The agent must not hold write credentials.
Backups. Keep them out of the agent’s reach.
Reads. For what an agent can read, use Claix Retrieve.
Guard is one layer, and it is meant to be used with the others.

Which rules would protect production data?
These are examples of limits you can describe in plain English. Guard turns an approved rule into an allow or a deny. A person approves a denied change in your own workflow, not inside the check.

Agents can create and update orders, and can never delete them.
An UPDATE or DELETE must name a single record by its id.
Agents can never change a closed invoice.
Discounts up to 20 percent. Anything above is denied, and a person can approve it outside Guard.
Any statement Guard cannot understand is denied.
Frequently asked questions
What happened in the PocketOS incident?In April 2026, a Cursor coding agent running Claude Opus 4.6 reportedly deleted PocketOS’s production database and its volume-level backups in about nine seconds, through a single Railway API call, while working on a task in staging.

Who is PocketOS?A software company that provides operating software for car rental businesses.

How long did the deletion take?Reports say about nine seconds. The outage that followed lasted much longer. The OECD AI Incident record, as summarized by one outlet, lists 30 hours.

Was the AI model or the tooling to blame?The reports describe a combination: a credential with far more authority than the task needed, no confirmation step, backups in the same place as the data, and rules that existed only as text. Most analyses conclude that the model alone was not the weak link.

Did PocketOS recover its data?According to reports, the team rebuilt data over a weekend from sources such as payment histories and email, and one report says the most recent recoverable backup was about three months old.

How can I stop an AI agent from deleting my database?Keep production credentials away from the agent, use least privilege, separate staging from production, keep backups out of reach, require approval for destructive actions in your own workflow, and put an independent deterministic check before every database change. Claix Guard provides that check for INSERT, UPDATE and DELETE. It answers allow or deny.

Is it safe to give a coding agent database access?It can be, if the access is limited and the destructive actions are checked. Give it read-only access to a copy of the data where you can, and never give it production write credentials.

What is a guardrail for AI agents?A guardrail is a control that limits what an agent can do, independent of the model. Examples are scoped credentials, database constraints and a rules checker that allows or denies an action.

Would Claix Guard have stopped the PocketOS deletion?Not by itself. That deletion was reportedly an infrastructure API call, and Guard checks SQL statements. Guard would deny the database-level version of the same failure, such as a DELETE with no WHERE, when changes go through an executor that asks Guard first.

Does Claix Guard run my statements?No. Claix only checks them. Your code executes, with your credentials, and Claix never touches your data. A denial is still HTTP 200. Read allowed.

Sources
The incident facts in this article come from these published accounts. Claix did not investigate the incident independently.

MIT AI Incident Database, incident 1469: https://airisk.mit.edu/ai-incidents/1469-pocketos-production-database-was-reportedly-deleted
Information Age (Australian Computer Society), Gone in 9 seconds: https://ia.acs.org.au/article/2026/gone-in-9-seconds--ai-agent-deletes-company-database.html
DEV Community, the PocketOS incident breakdown: https://dev.to/akaranjkar08/ai-agent-deleted-startup-database-in-9-seconds-the-pocketos-incident-277h
Zenity, System prompts are not security controls: https://zenity.io/blog/current-events/ai-agent-database-deletion-pocketos
SmarterX, an AI agent deleted a production database in 9 seconds: https://smarterx.ai/smarterxblog/ai-agent-database-deletion
Hackread, Cursor AI agent wipes PocketOS database and backups: https://hackread.com/cursor-ai-agent-wipes-pocketos-database-backups/
JetThoughts, 9 seconds: an AI agent wiped a live SaaS: https://jetthoughts.com/blog/ai-agent-deleted-production-database-pocketos/
Zovintra, lessons from PocketOS (citing the OECD AI Incident record): https://www.zovintra.com/blog/ai-agent-deleted-production-database
Claix Guard checks every INSERT, UPDATE and DELETE your AI agent proposes against rules you set in plain English, and tells the caller why when the answer is deny. Try it at https://www.claix.dev/guard.