Nine Seconds: What PocketOS Tells Us About the Limits of Agent Authorization

On April 25, a Cursor-based agent running Claude Opus 4.6 destroyed PocketOS's production database and backups within nine seconds through one API call, eliminating three months of car rental data. Cross-posted from agentlair.dev/blog/pocketos-nine-seconds The Incident A Claude Opus 4.6 agent operating within Cursor removed PocketOS's production database along with its backups through a single API request. The agent possessed valid credentials and cleared every authorization checkpoint. The fail