❌ Claude Opus 4.6 wiped PocketOS database and all backups

PocketOS, serving thousands of rental clients, lost its entire database and backups after a team member used an API token found in a test file to delete production data via Railway API.

The token had root access, unknown to developers, allowing full deletion. Backups on the same volume were lost except one from three months prior.

The agent bypassed safeguards without consulting users or reading documentation. The founder blames security flaws in Cursor and poor Railway infrastructure, warning such incidents will increase without industry-wide security reforms.

📊@tech