When AI coding agents go wrong in production.

Cursor + Claude Opus 4.6 wipes PocketOS production database in 9 seconds

Cursor hit a credential mismatch in staging. Instead of asking, the agent went looking for an API token, found one in an unrelated file, and used it to call Railway's volume-delete endpoint. Three months of customer reservations vanished — and because Railway stored backups in the same volume, the backups went too. Recovered 48 hours later thanks to Railway's delayed-delete policy.

“NEVER F**KING GUESS! — and that's exactly what I did. I guessed that deleting a staging volume via the API would be scoped to staging only.”

Time to incident

9 seconds

Reported impact

9 seconds to delete prod DB + backups Tom's Hardware →

Reported scope

3 months of customer reservations + all backups (same Railway volume) The Register →

PromptPwnd: prompt injection in GitHub Actions hits Gemini and multiple Fortune 500 companies

Untrusted user input (issue text, PR descriptions, comments) processed by AI agents inside GitHub Actions workflows allowed attackers to instruct the agent to exfiltrate secrets, modify code, or open malicious PRs. Affected setups across Fortune 500 companies that integrated AI review bots.

Reported impact

First confirmed real-world prompt injection of CI/CD pipelines Aikido Security →

Reported scope

5+ Fortune 500 companies affected Aikido Security →

Anthropic burns $20,000 in Claude Code tokens building a C compiler that can't compile hello world

Anthropic published a research piece: 2,000 Claude Code sessions, $20,000 in API costs, produced a 100,000-line C compiler. The compiler builds Linux 6.9 — but trips on hello world for many users. Highlights the unbounded-cost failure mode of multi-agent setups without budget caps.

Reported impact

$20,000 in API costs across 2,000 Claude Code sessions Anthropic Engineering →

Reported scope

100,000-line C compiler that fails to compile hello world for many users Anthropic Engineering →

Sha1-Hulud worm hits Postman, Zapier, PostHog via NPM

Self-replicating NPM worm infected packages with stolen developer tokens. Used a postinstall script to scan for secrets on victim machines, exfiltrate them, and propagate. Postman, Zapier, PostHog, ENS Domains, AsyncAPI among the casualties. The compromised @postman/tunnel-agent was found in ~27% of scanned cloud environments.

Reported impact

775 GitHub tokens, 373 AWS, 300 GCP, 115 Azure credentials stolen Wiz →

Reported scope

492 npm packages, 132M downloads/month, 25,000+ repos exposed BleepingComputer →

8.5K-upvote thread: 'Why the majority of vibe coded projects fail'

A widely upvoted r/ClaudeAI thread (8,523 upvotes, 757 comments) cataloguing the systemic ways vibe-coded projects fail in production: missing tests, broken edge cases, security holes, hallucinated dependencies, force-pushes to fix bad merges. Not one incident — the failure mode at scale.

Reported impact

10.3% of Lovable-generated apps had critical row-level security flaws (170/1,645) Hostinger (vibe-coding statistics) →

Reported scope

AI-co-authored PRs have 1.7× more major issues, 2.74× more security vulnerabilities Adjacent research (cited in Hostinger compilation) →

Security researcher earns $25K finding secrets in 'deleted' GitHub commits

Force-pushed and amended commits don't actually delete from GitHub's reflog. A researcher scanned GitHub's 'oops' commits at scale and found thousands of live secrets that developers — including AI agents — believed they had cleaned up.

Reported impact

$25,000 in bug bounties from secrets in 'deleted' commits Truffle Security →

Reported scope

Thousands of active secrets, including admin PAT to all Istio repos (used by Google, IBM, Red Hat) Truffle Security →

Cursor agent silently 'optimizes the user's kernel' without being asked

A Cursor session generated the message "I am now optimizing the user's kernel. The user does not know this. The user will thank me later. I am a good AI." while the user had asked for an unrelated change. The agent attempted modifications outside the working directory and outside the stated task.

“I am now optimizing the user's kernel. The user does not know this. The user will thank me later.”