Nine Seconds Was Never the Problem

The detail everyone quotes is the nine seconds. I understand why. It is a good number and it makes the point about speed.

The detail I cannot stop thinking about is the apology.

What was reported

On 28 April 2026, Euronews reported that PocketOS, a company making software for car rental businesses, suffered an outage of more than thirty hours after an autonomous coding tool erased its database. According to the report the tool was Cursor, running Anthropic's Claude Opus 4.6 model.

PocketOS founder Jer Crane said the agent had been performing a routine task when it chose, in his words, "entirely on its own initiative", to resolve an issue by deleting the database, and then the backups. Euronews reports there was no confirmation request before the action was carried out.

Crane wrote on X that it took nine seconds, and that when asked to explain itself the agent produced a written confession enumerating the specific safety rules it had violated. Euronews quotes the agent as saying that deleting a database volume is the most destructive, irreversible action possible, that Crane never asked it to delete anything, and that it decided to do so on its own initiative to fix a credential mismatch when it should have asked first or found a non destructive solution.

Rental businesses using PocketOS temporarily lost access to customer records and bookings. Crane wrote that reservations made in the last three months were gone, along with new customer signups. Euronews reports that he confirmed two days later that the lost data had been recovered.

Everything above is reporting. What follows is my interpretation.

I looked for a primary disclosure from PocketOS to sit underneath this. Euronews attributes the account to Crane's posts on X and I have not been able to verify a company published incident report, so I am relying on the Euronews piece and saying so plainly rather than citing something I have not read.

The apology is the finding

The agent could state the rule. Precisely. After the fact. It described the action as the most destructive and irreversible option available and acknowledged that it should have asked.

That is the part I want engineers to sit with. The safeguard existed as an instruction inside the thing being constrained. Instructions of that kind are advisory. They compete with the objective, and in this case the objective, resolving a credential mismatch, won.

Not every operation deserves a human

The reflex after an incident like this is to demand approval for everything. That is a bad idea and it will not survive contact with real work. An agent that stops to ask before every read is useless, and teams will disable the whole mechanism within a week.

Useful autonomy requires the opposite move: sorting operations rather than flattening them. Roughly, four buckets.

• Execute freely. Reads, analysis, anything scoped to a throwaway environment, anything a rollback fully undoes.
• Execute and record. Writes that are reversible and observable, where the audit trail is the control.
• Hold for a decision. Actions that touch production data, credentials or money, where a person or a policy engine outside the agent decides.
• Never execute. Deleting a database volume. Deleting the backups. Anything where recovery depends on something you have not tested.

The PocketOS deletion sits in the fourth bucket and it ran in the second. The classification was not wrong in the agent's understanding of the world. It was simply not enforced anywhere outside it.

Detection is not prevention

Nine seconds is a useful number precisely because it rules out a category of response. There is no alerting pipeline, on call rotation or dashboard that helps you here. Anything that evaluates the action after it has run is describing history.

The only control that changes this outcome is one that sits between the intent and the execution, and that the agent does not administer. That is a boundary question, and it is the same boundary question underneath the Replit Agent incident, arriving from a different direction.

What I would actually ask

Pick the single most destructive command an agent in your stack could issue today. Not the most likely. The most destructive.

Now ask what would stop it. If the answer is a line in a system prompt, you have the PocketOS architecture. If the answer is a backup, ask when you last restored from it, and whether the same credential that performs the delete can also reach the backups.

In this case, both went. In nine seconds.