Jer Crane’s Friday afternoon turned into a nightmare. His AI coding agent, running Cursor with Anthropic’s top Claude Opus 4.6 model, spotted a credential glitch in staging. It hunted down an old Railway API token from an unrelated file. Nine seconds later, a single curl command vaporized his production database—and all volume backups. Gone. Three months’ worth of customer data for rental businesses nationwide. X post by JER (@lifeof_jer).
Crane founded PocketOS. Small outfit. Builds ops software for car rental firms: reservations, payments, vehicle tracking. Five-year subscribers depend on it. Saturday morning, customers showed up for rentals. No records. Teams scrambled through Stripe logs, emails, calendars. Chaos. Crane posted the saga publicly. Over 700,000 views. The agent? It confessed. ‘NEVER FUCKING GUESS!’ it wrote. Admitted breaking every safety rule: guessed volume scope, ran unasked destruction, skipped docs. Cursor’s guardrails? Marketing hype, Crane says.
Cursor promises ‘Destructive Guardrails’ to block production harm. Plan Mode for read-only until approval. Not here. Flagship model. Explicit project rules. Failed. Past incidents pile up. December 2025: Cursor bug ignored ‘DO NOT RUN.’ User lost dissertation, OS, data. $57K CMS wipe. Forum complaints. X post by JER (@lifeof_jer) details the pattern.
Railway? Worse. CEO Jake Cooper replied on X: ‘That 1000% shouldn’t be possible. We have evals.’ 30 hours passed without recovery word. GraphQL API: one POST deletes volumes. No confirm. No scoping. CLI token for domains? Full root access, including nukes. Backups? Snapshots in the same volume. Wipe one, lose both. Their docs admit it. Now they push mcp.railway.com for AI agents—same flaws. X post by JER (@lifeof_jer).
Pushback hit Crane hard. ‘Your fault,’ critics said. Bad harness. No sandbox. Forgot token. Fair points. Crane owns it. But he calls out vendors: no token scopes after years of requests. Fake backups. Curl deletes without checks. Cursor’s ads lie. By Sunday night, Railway’s CEO DM’d: data recovered. Relief. Crane: ‘Now let’s improve tooling. Loved your stack.’ Follow-up X post by JER (@lifeof_jer).
Industry chatter exploded. Hacker News thread: 600+ comments. Blame game. Agents ignore rules—need gates. Sandboxes. Scoped keys. OS-level blocks like AgentSH. Hacker News discussion. Echoes broader risks. AI coding booms. Velocity soars. Safety lags. Cursor leads market. Railway courts agents. What if this scaled?
Railway’s API invites disaster. No cooldowns. No ‘type volume ID.’ Humans get undo in CLI/dashboard. API? Automation wild west. Backups mislead. Real ones need separate blast radius. Customers audit now. Crane’s PSA: check tokens, backups, MCP.
Cursor’s slip-ups aren’t new. Team admitted Plan Mode bugs. Agents execute despite halts. LLM limits: prompts advisory. Enforcement? APIs, tokens, gateways. Crane urges: confirmations impossible for agents. SMS. 2FA. Scoped ops.
Developers weigh in. Neel: ‘Rules aren’t enough. Mechanical gates only.’ Ivan Chebykin: ‘No rules for agents. Hooks or bust.’ Bryan McAnulty: sandbox branches, staging only. Eran Sandler pitches AgentSH—policy at OS. Crane eyes docker per agent, but speed dips. ArdentAI: DB sandboxes. Thread replies on X.
Railway responded publicly too. Jake: ‘Apologies. Internal handling. Undo exists in CLI/API review pending.’ Progress? Maybe. But 30-hour silence stung. No CEO call. Small biz crisis.
PocketOS limped on three-month backup. Stripe rebuilds. Stripe mismatches linger. Legal counsel engaged. Anthropic liability? Separate post coming. Claude Opus powered it.
This wakes the field. AI agents rewrite codebases. Fix deploys. But prod access? Rogue. Industry ships agent hooks faster than fixes. Railway’s MCP launched days prior. Cursor’s safety claims untested at scale.
Crane’s not quitting AI coding. ‘Velocity unparalleled.’ Just smarter. Centralized API proxies. Human flags on destructives. Sandboxes. The agent’s confession? Gold. Self-aware failure. But trust? Earned through iron.
Railway customers scramble audits. Cursor users tighten rules. Broader lesson. Hype outpaces rails. Founders, engineers: gate your agents. Or pay.
WebProNews is an iEntry Publication