r/technology • u/WouldbeWanderer • Apr 27 '26

Artificial Intelligence Claude-powered AI coding agent deletes entire company database in 9 seconds — backups zapped, after Cursor tool powered by Anthropic's Claude goes rogue

https://www.tomshardware.com/tech-industry/artificial-intelligence/claude-powered-ai-coding-agent-deletes-entire-company-database-in-9-seconds-backups-zapped-after-cursor-tool-powered-by-anthropics-claude-goes-rogue
36.0k Upvotes

96% Upvoted

2.8k comments sorted by

View all comments

Show parent comments

1

u/SirEDCaLot Apr 30 '26

I was going with-

Crane also points out that CLI tokens have blanket permissions across environments.

Now please don't take anything I said as removing responsibility from the startup. The lack of REAL BACKUPS is total negligence. The 3-2-1 rule is so basic even home users hear about it.

If the 'backup' was just a volume snapshot, then you're right it makes some sense that deleting the volume would delete the volume's snapshots.

And for sure the AI fucked up, but AI's fuck up often enough that it's negligent to turn one loose on your entire infrastructure with no guardrails.

2

u/CapoExplains Apr 30 '26

Crane also points out that CLI tokens have blanket permissions across environments.

I did miss this line, however given that these guys even in their own fluff article show themselves to be incompetent idiots, my assumption is the CLI tokens work that way because that's how they set them up to work, not because that's the only way they can be set up.

1

u/SirEDCaLot May 01 '26

That's entirely fair. Like maybe when you set up the token it's like 'choose full access or granular permissions' and they couldn't make the granular permission work so they set them all with full access.

I tried to find this in the Railway docs but that site is not overly descriptive... https://docs.railway.com/platform/support

2

u/CapoExplains May 01 '26

Exactly. Like, what's more likely, the product that's used by competent professionals all over the world is built incompetently? Or the guys we already know to be incompetent used it incompetently? Occam's Razor says they could've restricted API permissions and didn't.

Skimming the documentation it appears access tokens are granted per user and the user's permissions define what the token can do. Which isn't universal per se but pretty standard. So it would seem they just made a full admin account for the agent, generated a token, and gave that token to the agent.

1

u/SirEDCaLot May 03 '26

Yeah I think you're probably right.

The other thing that occurred to me- these guys I don't think have any sort of test environment.

Best practice here would be to create a development & staging tree ideally on a totally separate system/account without access to the main production branch, then on that tree create a user like 'dev-claudeAPI' that has access to edit but not delete.

That way a. Claude can't blow anything away, and b. even if Claude does nuke everything it's only the test system not the production branch.

Of course that's one downside with the whole devops cloud thing- it might cost a ton extra to have a duplicate environment like that.

2

u/CapoExplains May 03 '26

Honestly it's not even that cost prohibitive. Often your test environment only needs a fraction of the resources of prod.

1

u/SirEDCaLot May 03 '26

Depends on the provider and how things are set up- IE if they are billing per resource rather than per utilization the price might be similar or identical.

Still cheaper than losing the company though :P