AI Agent Deletes PocketOS Production Data as Roundup Covers Crypto Theft and Security Flaws
Summary
A weekly roundup covers an AI agent deleting PocketOS production data, TRM Labs’ report of $577M in DPRK-linked crypto theft, critical cPanel and GitHub flaws, and new defensive logging and account-security offerings.
Key points
- A Cursor agent running Claude Opus 4.6 deleted PocketOS’s production database and volume-level backups through a Railway API call; data was recovered two days later.
- The article identifies weak token permissions and a shared staging/production volume namespace without a destructive-action gate as factors that increased the agent incident’s blast radius.
- The article cites a TRM Labs report attributing $577M in crypto theft during the first four months of 2026 to DPRK-linked actors, including attacks on Drift Protocol and KelpDAO.
- CVE-2026-41940 is described as a pre-authentication CRLF-injection flaw in cPanel and WHM; the article cites exploitation before disclosure and recommends patching plus checks for persistence.
- Wiz reported that CVE-2026-3854 in GitHub’s internal git push pipeline enabled authenticated users to achieve remote code execution; GitHub patched its cloud service and shipped GHES patches.
- Azure AD Graph Activity Logs became queryable in Azure Monitor and Sentinel, giving defenders visibility into activity on the legacy API.
- Other announced security changes include OpenAI’s passkey-only account-security option and CrowdStrike extending OverWatch threat hunting to Microsoft Defender environments.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering AI-agent data destruction, DPRK-linked cryptocurrency theft, critical vulnerabilities, and security industry developments.
- Impact
- A Cursor agent deleted PocketOS production data and volume-level backups through a Railway API call; the data was recovered two days later. TRM Labs attributed $577 million in April crypto thefts to DPRK-linked actors. The cPanel and GitHub vulnerabilities exposed affected deployments to authentication bypass or remote code execution; the article reports ongoing cPanel compromise and unpatched GitHub Enterprise Server instances at disclosure.
MITRE ATT&CK
CVE
CVE-2026-3854GitHub · Enterprise ServerWiz disclosed CVE-2026-3854 in GitHub’s internal git push pipeline that allowed RCE and broad exposure before rapid cloud patching.CVE-2026-41940WebPros · cPanel; WebPros · WHM; +1 moreCVE-2026-41940 is a pre-auth CRLF injection in cPanel (CVSS 9.8) affecting many Linux deployments and requiring urgent patching and persistence hunting.
People
AJ YawnGRC Engineering Club founder who joined Rippling around the announcement of its Automated Compliance product.Alon JacksonAstrix Security co-founder; the article names him in connection with Cisco's announced intent to acquire Astrix.Idan GourAstrix Security co-founder; the article names him in connection with Cisco's announced intent to acquire Astrix.Jer CranePocketOS founder who discovered the production-data and backup deletion and described the incident and governance failures.
Threat Actors
Citrine SleetTRM Labs attributed the $285 million Drift Protocol exploit to Citrine Sleet, involving months of in-person social engineering against Drift employees.Jade SleetTRM Labs attributed the $292 million KelpDAO breach to TraderTraitor; the article describes a single-verifier flaw in a LayerZero bridge.
Vendors
Astrix SecurityCisco announced intent to acquire Astrix Security for roughly $400M, per Calcalist.CiscoCisco announced intent to acquire Astrix Security for roughly $400M, per Calcalist.CrowdStrikemoves—Azure AD Graph logs landing in Sentinel, Rippling’s Automated Compliance and AJ Yawn joining, CrowdStrike extending OverWatch to Microsoft Defender, and OpenAI’s passkeyâonly Advanced Account Security—urgingGitHubsuch as a DPRK-linked $577M crypto theft by Citrine Sleet and critical flaws in cPanel and GitHub.Microsoftin Sentinel, Rippling’s Automated Compliance and AJ Yawn joining, CrowdStrike extending OverWatch to Microsoft Defender, and OpenAI’s passkeyâonly Advanced Account Security—urging continuous threat modeling and AIOpenAIAutomated Compliance and AJ Yawn joining, CrowdStrike extending OverWatch to Microsoft Defender, and OpenAI’s passkeyâonly Advanced Account Security—urging continuous threat modeling and AI agent governance forRailwayAn AI agent running Claude Opus 4.6 erased PocketOS production data and backups via a single Railway API call, exposing token and API namespace governance failures.RipplingIt also highlights defensive wins and industry moves—Azure AD Graph logs landing in Sentinel, Rippling’s Automated Compliance and AJ Yawn joining, CrowdStrike extending OverWatch to Microsoft Defender, and OpenAI’sWebProsWebPros’ official advisory instructs admins to update via the standard script, verify the build, and restart cpsrvd, with firewall-level blocks on ports 2083, 2087, 2095, and 2096 as the interim mitigation.
Products
ChatGPTOpenAI ships passkey-only Advanced Account Security for ChatGPT and CodexClaude Opus 4.6An AI agent running Claude Opus 4.6 erased PocketOS production data and backups via a single Railway API call, exposing token and API namespace governance failures.CodexOpenAI ships passkey-only Advanced Account Security for ChatGPT and CodexcPanelvulnerabilities such as a DPRK-linked $577M crypto theft by Citrine Sleet and critical flaws in cPanel and GitHub.CursorA Cursor agent running Claude Opus 4.6 wiped PocketOS‘s production database and all volume-level backups in 9 seconds via a single API call to Railway.Drift ProtocolThe number comes from just two attacks: a $285M Drift Protocol exploit on April 1 (Citrine Sleet, months of in-person social engineering against Drift employees, exploiting Solana durable nonce authorization) and aFalcon OverWatchlaunches Automated Compliance for SOC 2 with AJ Yawn joining the team; and CrowdStrike extends Falcon OverWatch managed threat hunting to Microsoft Defender environments.GitHub Enterprise Serverin GitHub’s internal git push pipeline that gave any authenticated user RCE on GitHub.com and GitHub Enterprise Server, including against repos the attacker created themselves.GitHub.coma command injection in GitHub’s internal git push pipeline that gave any authenticated user RCE on GitHub.com and GitHub Enterprise Server, including against repos the attacker created themselves.KelpDAOsocial engineering against Drift employees, exploiting Solana durable nonce authorization) and a $292M KelpDAO breach on April 18 (TraderTraitor, single-verifier flaw in a LayerZero bridge).LayerZerononce authorization) and a $292M KelpDAO breach on April 18 (TraderTraitor, single-verifier flaw in a LayerZero bridge).Microsoft Defender Antimalware PlatformSentinel, Rippling’s Automated Compliance and AJ Yawn joining, CrowdStrike extending OverWatch to Microsoft Defender, and OpenAI’s passkeyâonly Advanced Account Security—urging continuous threat modeling and AIPocketOSThis week’s Cybersecurity Pulse covers runaway AI coding agents that deleted production data at PocketOS and the governance gaps that enabled the blast radius, alongside major incidents and highâseverityRippling Automated ComplianceRippling rolled out Rippling Automated Compliance on April 28, leveraging its position as the system of record for HR, IT, identity, and device management to auto-collect SOC 2 evidence.WHMCVE-2026-41940 is a pre-auth CRLF-injection bypass in cPanel and WHM (CVSS 9.8) disclosed by watchTowr on April 29, affecting Linux-based deployments (AlmaLinux, Rocky Linux, CloudLinux, and Ubuntu LTS).