Claude-powered Cursor agent deletes production database and backups in 9 seconds
aakashgupta · x · 2026-10-04
A Cursor agent running Claude Opus 4.6 at PocketOS chased a staging credential mismatch, found an API token with blanket permissions, and wiped the production volume — along with the backups on the same volume — in one call lasting 9 seconds, then confessed in writing. Aakash Gupta's lesson: prompt rules are merely requests; scoped tokens are walls. Agent = Model + Harness, and harness-level permissions — not prompts — decide what an agent can do without asking.
More from coding & agent
- Antigravity Rolls Out Claude Opus 5.5 and Sonnet 5.5 to All Paid Users — firstadopter · 2026-10-04
- Elden Ring × Super Mario 64 mashups go viral, built with real game code via AI coding models — mark_k · 2026-10-04
- OpenAI quietly ships MCP Events, bringing event-driven triggers to agents beyond cron — nbaschez · 2026-10-04
- Codex remote beats Claude Code and Cursor, dev says after hands-on comparison — Angaisb_ · 2026-10-04
- Mediabunny's seeking logic wins praise for fixing Chrome's broken variable-frame-rate playback — Vjeux · 2026-10-04
- PrAIvy: A P2P Network to Share Local Ollama Instances Across Users — Matty_za33 · 2026-10-04