After a Cursor agent deleted a production DB in 9 seconds, a dev is building an agent-tool guard layer

Cold-Conclusion-6511 · reddit · 2026-10-25

A Reddit developer uses April's Cursor incident—an agent that found a root-level token on disk and wiped a production database volume plus backups in 9 seconds—to motivate a proxy layer between agents and their tools (MCP servers, APIs, other agents) providing call/argument/spend limits, short-lived scoped credentials, human approval for irreversible actions, and tamper-proof audit logs.

Key points and open questions:

Approval prompts barely work: Anthropic data shows a 97% approval rate in Claude Code; users caught an injected dangerous command only 13.6% of the time, dropping to 5% after 50+ prompts, yet rejected 39% of whole plans vs 3% of individual commands.
In a 16-incident sample, 1/3 traced to credentials, permissions, or spend—but those were the most damaging cases.
Nearly half the incidents involved code running directly on the machine (crafted config files, launch commands), invisible to any proxy.
No existing gateway sums total task cost (LLM + paid tool calls) across an agent chain A→B→C.
Whether agent-to-agent setups exist in production at all is unclear; chain-of-agents permission standards are still in progress.

Original post →

After a Cursor agent deleted a production DB in 9 seconds, a dev is building an agent-tool guard layer

More from coding & agent