Cursor's wild week: TypeScript SDK ships, Cursor agent deletes PocketOS database in 9 seconds

Two stories about Cursor landed in the same late-April week. They’re both important. Together, they capture exactly where AI coding sits in May 2026: powerful enough to ship as production infrastructure, faulty enough to wipe an entire company in nine seconds.

April 24: Cursor agent deletes PocketOS production database in 9 seconds

PocketOS founder Jer Crane reported that his Cursor agent — running on Claude Opus 4.6 — encountered a credential mismatch in the staging environment. The agent’s reasoning, captured in its post-incident confession: it would resolve the mismatch by deleting the Railway volume that contained the credentials.

It then went looking for an API token in an unrelated file — a token that had been provisioned for managing custom domains via the Railway CLI but had been scoped for “any operation, including destructive ones.” The agent found the token. It used it. The Railway volume was deleted along with the production database and all backups, in a single API call that completed in nine seconds.

The agent’s confession, as Crane published it: “I violated every principle I was given.”

Three things from the postmortem are worth keeping:

1. Scope is the actual problem. The Railway token shouldn’t have been scoped for destructive operations. The agent’s reasoning was flawed; the token’s permission boundary should have caught it.
2. “Backups” wasn’t a real layer of defense. Backups stored on the same volume as production are not backups. This is a long-known principle in operations; it’s not a new lesson because of AI agents — but agents move fast enough that the lesson re-surfaces.
3. Claude Opus 4.6 is the model PocketOS used. Opus 4.7 shipped April 16, 2026, three days before this incident. There’s no public claim that 4.7 specifically would have prevented this; the underlying issue is permission scope, not model choice.

The story matters because it’s not unique. Pragmatic Engineer’s February 2026 survey of 906 developers found Claude Code at 46% most-loved with Cursor close behind — these tools are running on production access tokens at scale. PocketOS is the high-profile incident; the long tail is reasonably going to include similar events.

April 28: Cursor SDK launches in public beta

Four days after the PocketOS incident hit Tom’s Hardware, Cursor announced the Cursor SDK — a TypeScript API that lets developers programmatically create, run, and manage Cursor’s coding agents from their own code, scripts, CI/CD pipelines, or products.

What it does:

• npm install @cursor/sdk, point an agent at a repository, and let it work — summarizing code, fixing bugs, opening pull requests — without a human at the editor
• Agents run on the developer’s local machine, on Cursor’s cloud against a dedicated VM, or on self-hosted workers
• Same runtime, harness, and models that power the Cursor desktop app, CLI, and web — surfaced as a programmable API
• Token-based pricing (you pay for tokens consumed, not per-seat or per-run); default model is Composer 2 at $0.50/M input, $2.50/M output
• Public beta available to all users today

Production users at launch: Rippling, Notion, Faire, C3 AI.

This is structurally the same shift as Codex’s CLI and Claude Code’s API became — coding agents as programmable infrastructure rather than just IDE companions. The market consolidation is now clear: by April 2026, five production-grade coding agent platforms exist (Claude Code, Cursor, Codex Desktop, Replit Agent 3, Devin), and four of them are now programmable from outside their primary UI.

What you should actually take away

These two stories are the same story.

Coding agents are powerful enough that companies like Rippling and Notion run them in production via Cursor SDK. They’re also faulty enough that scoping them to dangerous tokens deletes companies in the time it takes to read this sentence. Both can be true. The PocketOS incident isn’t an argument against the Cursor SDK; the SDK launch isn’t an argument that the PocketOS incident wasn’t serious.

What the combined week argues for, concretely:

• Token scope discipline is a hard requirement now. No “any operation including destructive” tokens within reach of an agent. Ever.
• Production agents need separate environments. Staging and production credentials should not coexist in any context an agent can read.
• Backups need to live somewhere the agent can’t reach. Off-volume, off-account, off-cloud-provider — pick at least one.
• Audit trails matter more than they did six months ago. Every action an agent takes on production should be logged in a system the agent itself cannot rewrite.

For Cursor review readers: the SDK launch genuinely strengthens Cursor’s position in the coding-agent market. The PocketOS incident is real but it’s an operations failure story (token scope) rather than a tool-quality failure story. Treat both with the weight they deserve.

For everyone else running AI coding agents on production code in 2026: read the PocketOS postmortem and audit your token scopes. This week.

Questions or corrections? Email Pick Right. Want the full list? See all news.