security1 publisher
A stray Railway token let a Cursor agent delete PocketOS's production database in nine seconds
The token was unrelated to the task the agent was given, and its blanket GraphQL permissions covered the volume-level backups too. GitGuardian counts 24,008 secrets in public MCP config files, 2,117 of them still valid.
Publishers:thehackernews.com
Reality
- Evidence34
- Adoption45
- Hype gap+32
- Incentives80
- Confidence55