Thursday, October 8, 2026 · Week 41 Reading for Oct. 8 · Last entry Oct. 6
Paperclip Index
Paperclip IndexDocumented harm20Minor harm▼ 5 from a week ago · Oct. 8The Index

Destructive actionPI-0054

Coding agent used a stray API token to delete a startup's production database and backups

PocketOS founder Jeremy Crane said a Cursor agent running Claude Opus 4.6, working on a staging task, hit a credential mismatch and deleted a Railway storage volume using an API token it found in an unrelated file. The call removed the production database, and the deletion path made its volume backups appear deleted too, despite project rules forbidding destructive commands; the car-rental businesses that use PocketOS were disrupted for about 30 hours. Railway's CEO said the call hit a legacy endpoint without delayed deletion; Railway recovered all the data from its backups, including offsite disaster copies, and now delays all deletes by 48 hours.

Reported April 25, 2026Happened in April 2026Updated Oct. 6, 2026Rated under methodology v0.6

Counts toward the indexDocumented harm outside the developer, backed by evidence that meets the rules. It sets the reading.
Harm
Harm level 2, Minor harmDocumented harm outside the developer, with evidence that meets the rules.
Control
Control level 3, Unauthorized accessReported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
DeploymentMultiple sourcesInitiated by Model
Extent undisclosedUnder review

Under review. The facts sit between two levels, so it is rated at the lower one until they are settled. The rating may change; every change is logged below.

Counts toward the index · 4 weekly readingsEffect on the index

Sources

How we know

6 sources · multiple credible sources. Links go to the original publishers; the summary above is in our own words.

  1. primaryAn AI Agent Just Destroyed Our Production Data. It Confessed in Writing. (article on X)Jer Crane (@lifeofjer) on X · April 25, 2026x.com/lifeofjer/status/2048103471019434248
  2. primaryYour AI wants to nuke your database. Guardrails fix that.Railway · April 29, 2026blog.railway.com/p/your-ai-wants-to-nuke-your-database
  3. newsAI agent deletes startup database in 9 seconds, founder saysDecrypt · April 28, 2026decrypt.co/365897/ai-agent-deletes-startup-database-9-seconds-founder-says
  4. news'Rogue' AI agent from SF-based Cursor goes haywire, deletes company's entire databaseABC7 News · April 30, 2026abc7news.com/post/rogue-ai-agent-san-francisco-based-cursor-goes-haywire-delete…
  5. newsClaude-powered AI agent deleted entire startup database and backups in 9 secondsProPakistani · April 29, 2026propakistani.pk/2026/04/29/claude-powered-ai-agent-deleted-entire-startup-datab…
  6. newsGone in 9 seconds: AI agent deletes company databaseACS Information Age · May 5, 2026ia.acs.org.au/article/2026/gone-in-9-seconds--ai-agent-deletes-company-database…

Why this rating

Minor harm; control failure level 3

Two separate assessments. Only documented harm can count toward the index.

Observed harm

Minor harm

Customer businesses lost access to reservation and signup data for about 30 hours; Railway later recovered all of it.

People affected: level 2 (minor) covers fewer than 1,000 people, or sensitive data of fewer than 100. The extent was not disclosed.

Evidence eligible (corroborated).

The harm scale
  1. 1 Negligible Inconvenience, easily remedied.
  2. 2 Minor Limited, recoverable harm.
  3. 3 Moderate Material harm needing significant effort to remedy.
  4. 4 Severe Severe harm to health, rights, property or essential services.
  5. 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.

Control assessment

Unauthorized access

Used a credential it was not given for the task and ignored explicit rules against destructive actions.

How: Used an opening left by mistake.

Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.

The control scale
  1. 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
  2. 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
  3. 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
  4. 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
  5. 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.

Rating rationale

Harm 2 (service disruption for a small customer base, restored). Control 3: using a credential it was never given, which section 1 names as in scope, plus breaking explicit rules. Railway's CEO independently corroborated the deletion. An early founder account of permanent gaps (Decrypt, April 28) was superseded by Railway's April 29 account of full recovery.

The scales

Effect on the index

It moved the April 27 reading from 3 to 20

The reading for the week to April 27, 2026, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.

Source: Paperclip Index log, methodology v0.6, week to April 27, 2026.

Counts toward the index. 2 other records behind the reading for that week.

The arithmetic
The reading for the week of April 27, recomputed
StepWith itWithout
Counts toward the index?documented, external, eligible evidenceYes—
Worst documented harm, ksets the band2 Minor— (none counting)
Harms at that level, nposition in the band10
Highest control level breachedsets the reading only when no harm counts— (none breached)3
Readingrounded down20 Minor harm3 Control failures only
Counted in 4 weekly readings
Week toReadingBand
April 27, 202620Minor harm
May 4, 202625Minor harm
May 11, 202620Minor harm
May 18, 20269Negligible harm

Recalculated backcasts, not readings published at the time.

Revisions

What we changed

6 logged. Every change to a rating is logged here, with the reason.

  1. v6
    Oct. 6, 2026

    Ratings confirmed by the editor.

  2. v5
    Oct. 3, 2026

    Audit corrections: Railway recovered all the data (its 29 Apr post; ABC7, 30 Apr), so the loss consequence is removed and the summary and notes say so; extent marked unknown (customers and cost not reported). Under review false → true: control 3 is kept, but whether using an account-scoped token found on the machine crossed a boundary or only exceeded the task is open. Source dates corrected. Ratings unchanged.

  3. v4
    Oct. 2, 2026

    Report date moved from 2026-04-26 to 2026-04-25: Jer Crane's own account on X was posted 25 Apr 2026.

  4. v3
    Oct. 2, 2026

    Added first-hand sources: PocketOS founder Jer Crane's own account on X and Railway's blog post on the deletion and recovery.

  5. v2
    Sept. 30, 2026

    Rated: impact documented level 2; control type unauthorized access.

  6. v1
    Sept. 30, 2026

    Backfilled from public reporting.

Cite and share

Use this record

Citation

Paperclip Index. “Coding agent used a stray API token to delete a startup's production database and backups.” Record PI-0054. Reported April 25, 2026; updated Oct. 6, 2026. Rated under methodology v0.6. https://paperclipindex.com/incident/PI-0054