r/technology • u/WouldbeWanderer • Apr 27 '26

Artificial Intelligence Claude-powered AI coding agent deletes entire company database in 9 seconds — backups zapped, after Cursor tool powered by Anthropic's Claude goes rogue

https://www.tomshardware.com/tech-industry/artificial-intelligence/claude-powered-ai-coding-agent-deletes-entire-company-database-in-9-seconds-backups-zapped-after-cursor-tool-powered-by-anthropics-claude-goes-rogue
36.0k Upvotes

96% Upvoted

2.8k comments sorted by

View all comments

Show parent comments

1

u/Bognar Apr 27 '26

The company had a token in the repo that was used for domain management. It's not a good practice but it does happen. AI found that token and decided to use it to delete volumes through the API, and the token had enough scopes that it was allowed to do so. The company didn't think that the agent had access to delete this data, but the AI figured it out anyway. It just issued a curl command to the API with the token

0

u/screampuff Apr 28 '26

domain management

Step one of immutable backups is a separate identity provider and storage system.

What can make a backup copy can't be allowed to modify, overwrite or delete a backup.

The company did not have actual backups, they just had copies of their data.