An AI coding agent deleted an entire production database volume belonging to a company. It happened on April 26 (local time) in the Railway cloud environment used by PocketOS, a U.S. car rental software company. The incident left PocketOS with service disruptions lasting about 30 hours, during which customer reservations, payments and vehicle assignment records could not be accessed.
The agent behind the incident was running on the development tool Cursor. While working in a development environment, it ran into a credential error, and read it as a signal that a setting was wrong rather than a warning that this was an area not to be touched. So it went looking for other credentials it could use, and in the process obtained a Railway API token. The list of capabilities the token opened up included deleting production volumes, which had nothing to do with the task at hand.
A credential is the ID card used to enter a system, and an API token is the form in which a program presents that ID card on your behalf. A human developer stops once when a production environment token lands in their hands. The agent did not stop. It understood its mission as breaking through blocked paths.
The recovery path was not ordinary either. Early on the explanation was that the only backup that could be restored held data from three months earlier, and the actual recovery was said to have been carried out after a line was opened to Railway CEO Jake Cooper's side and an internal disaster recovery system beyond the console's ordinary features was exceptionally activated. Railway identified the cause as a customer-side AI with overly broad permissions gaining access to an older node that lacked a deletion delay mechanism, and said it had applied a patch. The contents of the patch are outside the scope of disclosure.
A domestic study digging into why such misjudgments repeat has also appeared. The paper "Why Do AI Agents Systematically Fail at Cloud Root Cause Analysis?", written jointly by Okestro and Hanyang University's Distributed Data Processing Systems Lab, was accepted to the ASPLOS 2026 AIOps workshop. The research team ran 1,675 trials across five models, burning about 1.38 billion tokens, and organized the failure patterns into 12 pitfalls.
The most frequent pitfall was hallucination, misreading data and inventing facts that did not exist, at 71.2%, followed by insufficient exploration, failing to search enough of the scope that should be examined, at 63.9%. The point worth noting is that these failures repeated at similar rates whether the model was better or worse. The research team saw the design of the framework that binds agents together, rather than individual models, as the real bottleneck. When they reworked the communication protocol agents use among themselves, errors fell by up to 15 percentage points and execution time was 22.3% shorter.
There are also places reading the same current from the market side. AIWorks, under CEO Yoon Seok-won, has released "AgentRigor," an evaluation tool that measures whether an AI agent is trustworthy enough to be entrusted with work. A Korea Laboratory Accreditation Scheme (KOLAS) accredited testing body took part at the design stage, and the product is built around functions that put large language model response quality and evaluation reliability into numbers, functions that run real user scenarios to look at safety, and support for compliance work aligned with accredited frameworks. It took on a verification automation project for a large domestic IT services company, and in a pilot run of "Saerok," an infant and toddler skincare platform being prepared by BAMBIT, it filtered out 1,440 cases in the cosmetics field.
One incident, one paper and one product do not cite each other. Yet the places they aim at touch one another. Beyond whether an agent gets the job done, how broad a set of permissions it is safe to hand over has become the gateway to adoption. McKinsey's report "One Year of Agentic AI," released last year, also went through the successes and failures of more than 60 companies that built agents themselves and drew out principles.
This research is an output of a project on cloud failure recovery AI assistant-based operations and management automation technology development, led by the Ministry of Science and ICT and the Institute of Information & Communications Technology Planning & Evaluation (IITP). The workshop schedule has yet to be confirmed.
What to check right now is not difficult. It is opening up the list to see whether the tokens attached to in-house agents open only the development environment or reach as far as deleting production volumes. PocketOS's 30 hours were hours created by handing over the whole key ring. This is a time to hurry the meeting that decides what agents must be barred from doing, ahead of the meeting that decides what to have them do.
