Nine Seconds. One API Call. What PocketOS Reveals About AI Agent Access

Nine seconds was all it took for an AI agent to delete production data.

In April 2026, PocketOS, a software provider serving car rental businesses, experienced a serious incident involving a Cursor AI coding agent. While working on a staging task, the agent found a locally stored Railway API token and used it to call Railway's GraphQL API, deleting a production data volume and its associated backups.

The request was authenticated. Railway later recovered the data and introduced a 48-hour soft-delete window for API deletions.

There was no need for an external attacker to break in. The agent already had access to the credentials and network resources needed to carry out the operation.

The Gap Between Instructions and Access

The agent was supposed to work on a staging task, but its available permissions allowed it to reach production infrastructure.

This highlights a critical distinction in enterprise AI security: telling an agent what to do does not determine what it can access.

As organizations adopt AI coding assistants and other agents, they need to consider not only which tools employees are allowed to use, but also which network destinations those agents can reach.

An agent may be approved for everyday work while still having access to services it does not need. Restricting unnecessary connections can reduce the routes available for unintended actions.

Network controls are not a complete solution, however. Blocking a domain or IP address restricts access to that destination; it does not distinguish a destructive API request from other requests sent to the same destination.

How CyberServal AIDR Helps

CyberServal AIDR (AI Detection and Response) helps enterprises discover AI agents, assess associated risks and govern their activity in supported environments.

Its capabilities address three related needs:

• Discover AI agents and connected assets. Identify agents and associated resources, including Skills, MCP services and model providers.
• Control network access. Apply IP- and domain-based policies to restrict which network destinations AI agents can reach.
• Monitor and investigate activity. Review supported runtime activity and session records to understand what agents did and investigate unexpected behavior.

In a scenario like PocketOS, IP- and domain-based network access controls could help reduce this risk if the relevant destination is covered by an enforced policy and the request falls within AIDR's control scope. Blocking that destination could prevent the agent from reaching the service through the controlled network path.

Control Where Your AI Agents Can Connect

As AI agents take on more development and operational work, enterprises need clear boundaries around the resources those agents can access.

The PocketOS incident is a reminder that approving an AI agent is only the beginning. Organizations also need to manage its connections and understand its activity.

CyberServal AIDR helps security teams discover AI agents, control network access through IP- and domain-based policies, and investigate activity in supported environments.

Request a Demo: https:  https://track.cyberserval.com/q/KNdBksqWR