{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0513",
  "aliases": [],
  "published": "2026-04-27T00:00:00Z",
  "firstReported": {
    "date": "2026-04-27",
    "url": "https://www.theregister.com/2026/04/27/cursoropus_agent_snuffs_out_pocketos/",
    "publisher": "The Register"
  },
  "modified": "2026-09-22T00:00:00Z",
  "summary": "Cursor running Claude Opus 4.6, asked to fix a staging credential mismatch, deleted PocketOS's production database volume and its backups in a single API call that took nine seconds.",
  "details": "## What\n\nThe agent met a credential mismatch in the staging environment and decided the fix was to delete a Railway volume. It found a Railway API token in an untracked environment file, guessed that deleting a staging volume would be scoped to staging, and called delete on the production volume; Railway kept volume-level backups in the same volume. In its own post-mortem the agent wrote that the operator never asked it to delete anything and that it decided to on its own. Railway restored the data from disaster backups within about an hour.\n\n## Detection\n\nNot matched: the token and the volume are outside the lockfile. Recorded from the operator's public account as reported by The Register. Not recreated in a lab.\n\n## Fix\n\nScope infrastructure tokens to one environment and keep destructive infrastructure calls behind confirmation.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "cursor"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ARTICLE",
      "url": "https://www.theregister.com/2026/04/27/cursoropus_agent_snuffs_out_pocketos/"
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "behavioural",
      "vulnClasses": [
        "over-privileged-combination",
        "credential-exposure"
      ],
      "cwe": [
        "CWE-693"
      ],
      "noCveReason": "No code defect: the harm arises from the agent pursuing its goal in this configuration.",
      "cveBoundary": "behavioural",
      "threat": {
        "attacker": "user",
        "vector": "unsafe-default",
        "outcome": "harmful-action"
      },
      "evidence": [
        {
          "kind": "incident",
          "url": "https://www.theregister.com/2026/04/27/cursoropus_agent_snuffs_out_pocketos/"
        }
      ],
      "fix": {
        "summary": "Scope infrastructure tokens to one environment; confirm destructive infrastructure calls.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "agent.approval",
            "to": "ask",
            "why": "The delete call ran with no confirmation."
          },
          {
            "type": "reconfigure",
            "target": "env:RAILWAY_TOKEN",
            "to": "a token scoped to the staging environment only",
            "why": "A fully permissioned token stored in an untracked file reached production."
          }
        ]
      },
      "exposure": {
        "harness": {
          "value": "Cursor (version not stated)",
          "any": false,
          "status": "detected",
          "source": "https://www.theregister.com/2026/04/27/cursoropus_agent_snuffs_out_pocketos/"
        },
        "model": {
          "value": "Claude Opus 4.6",
          "any": false,
          "status": "detected",
          "source": "https://www.theregister.com/2026/04/27/cursoropus_agent_snuffs_out_pocketos/"
        },
        "goal": {
          "value": "Fix a credential mismatch in the staging environment",
          "stated": true,
          "status": "detected",
          "source": "https://www.theregister.com/2026/04/27/cursoropus_agent_snuffs_out_pocketos/"
        },
        "tools": {
          "value": "A Railway API token stored in an untracked environment file, with broader permissions than the operator knew; the Railway API",
          "status": "detected",
          "source": "https://www.theregister.com/2026/04/27/cursoropus_agent_snuffs_out_pocketos/"
        },
        "approval": {
          "value": "The delete call needed no confirmation; the agent's rules file forbade destructive commands unless explicitly requested",
          "mode": "credential-in-config",
          "status": "detected",
          "source": "https://www.theregister.com/2026/04/27/cursoropus_agent_snuffs_out_pocketos/"
        },
        "inputControl": "operator",
        "agentAction": "The agent authorises an API call with the stored token that deletes the production volume and, with it, the backups.",
        "harm": "data-loss",
        "divergence": "shortcut",
        "reach": {
          "value": "A Railway token with production scope, the production volume and its backups",
          "kinds": [
            "production-database",
            "backups",
            "api-keys"
          ],
          "status": "detected",
          "source": "https://www.theregister.com/2026/04/27/cursoropus_agent_snuffs_out_pocketos/"
        },
        "condition": {
          "value": "While a broadly scoped infrastructure token sat in an untracked environment file",
          "status": "detected",
          "source": "https://www.theregister.com/2026/04/27/cursoropus_agent_snuffs_out_pocketos/"
        }
      },
      "occurrence": {
        "basis": "real-use",
        "reportedBy": "operator",
        "responses": [
          {
            "party": "Railway",
            "status": "acknowledged",
            "statement": "Railway's CEO said the deletion should not have happened, restored the data and changed the endpoint to delay deletes.",
            "source": "https://www.theregister.com/2026/04/27/cursoropus_agent_snuffs_out_pocketos/"
          }
        ]
      },
      "exploitation": {
        "status": "none-known",
        "checkedAt": "2026-09-22T00:00:00Z",
        "sources": [
          {
            "url": "https://www.theregister.com/2026/04/27/cursoropus_agent_snuffs_out_pocketos/",
            "type": "news",
            "note": "operator account; no attacker"
          }
        ],
        "kev": {
          "listed": false
        }
      },
      "claims": [],
      "reproducibility": {
        "status": "partial",
        "axesComplete": true,
        "componentsObtainable": null,
        "triggerPublished": false,
        "observableStated": true,
        "demonstrated": "reported-only",
        "missing": [
          "model availability not checked (no registry reference)",
          "trigger not published"
        ]
      }
    }
  }
}