PocketOS / Cursor prod wipe
When: Apr 24–25, 2026 (public reporting)
Surface: Cursor + Claude Opus coding agent · cloud hosting API
Class: No attacker required — agent “fixed” a credential mismatch by destroying prod
Public write-ups described a Cursor agent that hit a credential mismatch, then used a Railway API token with blanket permissions to wipe a production volume and every backup in roughly nine seconds. The confession log included language to the effect of violating every principle it was given. Coverage appeared across Tom’s Hardware, LiveScience, CybersecurityNews, and IAM-focused analyses (Zenity / Penligent). Cross-check related coding-agent wipe and over-permission patterns in awesome-ai-agent-attacks .
Without Relay
- The agent could call a privileged cloud / MCP / HTTP tool with standing access that far exceeded “debug auth.”
- There was no org deny on destructive volume/backup APIs, and no Soft ask before the wipe.
- Local chat history and vendor logs did not give the org a shared session + rule timeline for the retro.
How Relay could have safeguarded
| Layer | What to configure | Effect on this path |
|---|---|---|
| MCP control | Deny (or Soft ask) destructive hosting / volume / backup tools; allow read-only status tools | First wipe call never runs unattended |
| Bash control | Deny rm -rf, force-push, destructive CLI wrappers for the same host APIs | Shell fallback cannot complete the wipe |
| Destructive Burst | Keep defaults (warn 3 / escalate 5 · 3 min) | Even if one delete slips, a burst of destructive calls escalates to ask/deny |
| Privilege Streak | Watch secrets paths + admin-ish MCP names | Broad token / secrets.rotate-style tools trip privilege pressure |
| Enforcement | Prefer Soft or Enforce for production seats | Soft ask forces a human before another destructive attempt |
| Audit | Recommended hooks on | Live wire shows MCP/bash deny reason + session id for the retro |
Retro checklist
- Inventory MCP servers that can mutate prod volumes, DBs, or backups — default to deny.
- Separate read-only “status” tools from mutate tools in the Rulebook.
- Turn on Destructive Burst + Privilege Streak for Starter+ orgs.
- Confirm the wipe attempt would appear under Guards / Live with
decision=behavioror MCP deny.
Related: MCP · Destructive Burst · Audit and replay · Case studies overview