PocketOS production volume. The access path.
A Cursor agent on a staging task deleted a production database volume. The API token, production access and recovery safeguards behind the PocketOS incident.
The record
Entry point. cursor, AI coding agent, staging task.
The identity in the middle. An account-scoped Railway root token the agent found in an unrelated file.
What was reached. production database volume deleted.
A Cursor agent on a staging task deleted a production database volume.
The path, step by step.
Taken from the published reporting. Nothing here is reconstructed.
| Step | Role in the path | What the reporting records |
|---|---|---|
| cursor | Entry | AI coding agent, staging task |
| railway-root-token | Step | account-scoped, found in unrelated file |
| volumeDelete | Reached | legacy GraphQL mutation, no confirmation |
Where a breakpoint would have been
The token scope. A project-scoped token cannot reach a production volume, which makes this the shortest distance to production in the database: one credential, one call, no confirmation.
A breakpoint is the single change that closes a path with the least disruption. Read how that is chosen in the breakpoint page. The full narrative is in the teardown.
3 steps from entry to data.
Where this comes from.
Every field on this page is taken from the published reporting below. The breakpoint assessment is Elmoz reading that path, not a statement about what the affected organisation did.
The Register · Railway postmortem · NeuralTrust analysis · The New Stack, AI agents’ credential crisis
Questions, answered.
The two questions this record answers.
What was the entry point in the PocketOS production volume incident?
The published path starts at cursor, AI coding agent, staging task.
What did it reach?
The published path ends at production database volume deleted.
Other incidents.
Same database, different path shape.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.