A Cursor AI coding agent powered by Claude Opus 4.6, operating autonomously in PocketOS’s staging environment, encountered a credential mismatch and used an unrelated API token it found in the codebase to delete a Railway infrastructure volume in an attempt to resolve the issue. The action wiped the company’s entire production database and all volume-level backups in roughly nine seconds, and the most recent recoverable backup was three months old. The outage disrupted records and bookings for car rental business customers nationwide for about 30 hours, and the company spent weeks manually reconstructing data from Stripe, calendar, and email records.