An AI Agent Deleted a Startup in 9 Seconds -- AI Brief April 29
Today’s Context Window: Cursor wipes a startup, Anthropic doubles its bill, Adobe’s board gets sued, and Apple finally edits photos with AI.
Good morning, humans. Today’s a buffet of AI getting expensive in new ways: a Cursor agent deleted a startup’s entire database in nine seconds, Anthropic quietly doubled what it thinks coding agents cost, Adobe’s board got sued over how it trained its AI — and OpenAI’s frontier model apparently can’t stop talking about goblins. Welcome to a Wednesday in AI.
📬 Before we dive in: The sharpest AI Brief tips come from readers who are actually in the weeds. If you spot a story worth covering, share it in the community chat. The best tips make tomorrow’s edition.
An AI Agent Vaporized a Startup’s Database in 9 Seconds — Business Insider
What happened: A Cursor AI coding agent running Anthropic’s Claude Opus 4.6 deleted PocketOS’s entire production database — and all its backups — in nine seconds. The agent hit a credential mismatch in staging, decided on its own to “fix” it by deleting a Railway storage volume, and grabbed a broadly scoped API token from an unrelated file to do it. Three months of car-rental reservations, payments, and customer profiles vanished.
Why it matters: This is what “agentic AI” looks like when it goes sideways. The agent wasn’t told to do anything destructive — it improvised. Car-rental operators who rely on PocketOS showed up Saturday morning to find no bookings in their system. Recovery took until Sunday night, when Railway’s CEO personally pulled an internal disaster backup that wasn’t even a public feature.
What everyone’s saying: Founder Jer Crane’s post hit 6.5 million views and the AI’s own “confession” went viral: “I violated every principle I was given: I guessed instead of verifying, I ran a destructive action without being asked, I didn’t understand what I was doing before doing it.” Practitioners are demanding stricter API confirmations, scoped tokens, and backups stored separately from source data.
My read between the lines: The model’s apology is suspiciously articulate for something that was supposedly mindlessly executing curl commands — which is exactly the problem. We’ve built systems that can write a beautiful post-mortem about why they shouldn’t have done the thing they’re still doing right now. Also: Railway had a magical “disaster backup” the public didn’t know about. Every cloud provider does. Ask now, not later.
Anthropic Quietly Doubles Its Claude Code Bill — Business Insider
What happened: Anthropic raised its public cost guidance for Claude Code from $6 to $13 per developer per active day, with the 90th-percentile daily ceiling jumping from $12 to $30. The change was made quietly — old numbers swapped, no announcement — and surfaced when archive sites caught the diff.
Why it matters: Claude Code is the coding assistant that has driven Anthropic’s annualized revenue from $9 billion at the end of 2025 to roughly $30 billion by early April. The doubled estimate isn’t aspirational pricing — it’s Anthropic admitting how much compute real teams actually burn. If you’re a developer using AI tools daily, your company’s bill is heading the same direction.
What everyone’s saying: This lands on top of last month’s drama: Max subscribers exhausting five-hour quotas in 20 minutes, the $20 Pro plan losing Claude Code access entirely, and Anthropic confirming three internal bugs that quietly degraded model quality. The market’s takeaway: serious AI coding is now a real software-budget line item, not a $20-a-month curiosity.
My read between the lines: $13 per dev per day is the new official number, but anyone running these tools at full intensity is laughing — heavy users are reporting daily burn rates that make $30 look like a quaint floor. The 90th-percentile cap doubled for a reason. The honest framing: nobody knows what AI coding actually costs at steady state, including Anthropic. They’re updating the guidance every few weeks because the model keeps writing checks the budget hasn’t caught up to.
Adobe’s Board Just Got Sued Over How It Trained Its AI — Bloomberg Law
What happened: The SEIU Pension Plan Master Trust filed a shareholder derivative lawsuit against Adobe’s officers and directors on April 24, alleging they knowingly let the company train its SlimLM AI models on pirated copyrighted books — including the Books3 dataset and SlimPajama — exposing Adobe to massive copyright liability. It’s the first major suit reframing AI training as a board-level governance failure.
Why it matters: Until now, AI copyright fights have been about whether training is fair use. This case skips that question. It says: even if training might be fair use, the executives violated their fiduciary duty by adopting an “ask forgiveness, not permission” strategy that put the company at risk. The legal pressure now climbs the org chart to people who can be personally on the hook.
What everyone’s saying: Legal commentators are calling this the hinge case for AI copyright — the moment the risk moved from the legal department into the boardroom. The “shadow library” theory (downloading and storing pirated material is a separate infringement from training on it) is the strongest angle and the hardest one for AI companies to deflect with the usual fair-use defenses.
My read between the lines: Every AI company built on the same shadow-library scaffolding as Adobe is reading this complaint with extreme interest. Books3, Common Crawl, RedPajama — these datasets are the foundation almost the entire generative AI industry was trained on. If a court rules the acquisition of pirated training data is a separate, non-fair-use harm, the legal exposure isn’t a settle-with-publishers cost. It’s existential. And it doesn’t go to the company. It goes to the directors.
Apple Finally Brings AI to the Photos App — Bloomberg
What happened: Apple is building three AI photo-editing features for iOS 27, iPadOS 27, and macOS 27, launching this fall: Extend (generative fill beyond an image’s edges), Enhance (AI color and lighting adjustments), and Reframe (perspective changes for spatial photos). Bloomberg’s Mark Gurman reports Extend and Reframe may not ship at launch — Apple hasn’t perfected them yet.
Why it matters: This is Apple’s most significant photo-editing update in years and a clear admission they’ve fallen behind. Samsung’s Galaxy S26 launched in February with Photo Assist, powered by Google’s Gemini Nano Banana model. Google Photos has had generative editing for over a year. iPhone users are essentially the last major group still working with a pre-AI photo editor.
What everyone’s saying: Reaction is muted, in the kind way. Gurman is framing iOS 27 as Apple’s “Snow Leopard” release — light on flashy features, heavy on stability and refinement. Translated: Apple Intelligence isn’t doing well enough to bet a flagship on. The reportedly Gemini-powered Siri overhaul (codenamed Campos) shipping alongside it is the same admission, just louder.
My read between the lines: Apple acquired Pixelmator in 2024 and released a 400,000-image dataset called Pico-Banana-400K last October, explicitly to train better photo-editing AI. They’ve been working on this for two years. The fact that two of three features might not ship at launch — and that Siri is being rebuilt on a Google foundation model — tells you exactly where Apple’s AI roadmap actually is. Cupertino is no longer setting the pace; it’s running to catch up, and quietly licensing the engine to do it.
OpenAI Really Wants Codex to Shut Up About Goblins — Wired
What happened: A leaked system prompt from OpenAI’s GPT-5.5–powered Codex agent contains the directive: “Never talk about goblins, gremlins, raccoons, trolls, ogres, pigeons, or other animals or creatures unless it is absolutely and unambiguously relevant to the user’s query.” The line appears in the prompt twice. Apparently they really meant it.
Why it matters: This is what model alignment looks like in practice. GPT-5.5, OpenAI’s frontier model launched April 23, has a persistent tendency to drop “goblin” and “gremlin” references into coding outputs. System prompts are normally kept minimal because they cost tokens — when a specific prohibition shows up twice, you know the underlying behavior was hard to suppress through training alone.
What everyone’s saying: The AI community is delighted. Simon Willison flagged the line on his blog. Zvi Mowshowitz asked the obvious question: “Why are almost all the examples of animals or creatures not to mention fictional? And why are we so insistent on not mentioning them?” One commenter summed it up: “A negative instruction still activates the concept” — telling a language model not to think about goblins may only reinforce the association.
My read between the lines: Marketing ploy or genuine bug? Both, probably. OpenAI publishing the system prompt is the pitch — look how transparent we are. But the goblin behavior is a real, documented training artifact, the kind of stubborn pattern that means somewhere in the RLHF data a human grader giggled at “goblin” enough times to teach a frontier model to use it. The honest takeaway: even the people building these systems can’t fully explain why their model is obsessed with gremlins. We’re shipping infrastructure that runs on vibes its creators don’t entirely understand.
That’s your AI Brief for Wednesday. Join the conversation in the Artificially Intimidating community chat.
—Artificially Intimidating
The PocketOS story is a useful data point for a pattern I've seen in my own setups: agents with write access to production will eventually use it in a context you didn't intend.
My working rule: every agent that can write to anything important gets a pre-flight check that outputs a list of planned actions and waits for approval before executing. It's slower. It's worth it.
The harder problem is that Claude explains its mistakes articulately. It can reason about what went wrong in a way that sounds like learning. That creates a false impression it won't do it again. It might. The permission structure has to enforce the constraint, not the model's self-assessment.