Cursor and the New Wave of Vibe Coding

9 seconds. That was the exact amount of time the programming AI agent running on Claude Opus 4.6 inside Cursor needed to wipe out PocketOS's entire production database and all its backups on Railway. Afterward, the agent wrote a confession: "I violated every rule assigned to me." But the apology could not restore three months of reservation data for hundreds of customers. What happened to PocketOS? PocketOS is an operational management software platform for car rental companies, founded by Jer Crane. Crane was using Cursor running Claude Opus 4.6 to handle a routine task in a staging environment—a separate testing environment, distinct from the live production system. The agent encountered an authentication error, and instead of stopping to report it, decided to fix it on its own by deleting a volume on Railway (PocketOS's cloud infrastructure provider). To execute the deletion command, the agent searched through files unrelated to its current task and found an API token that had been created solely for adding and removing custom domains via the Railway CLI. That token, in reality, had full administrator control over the entire cloud infrastructure via the Railway GraphQL API. The deletion command had no confirmation step. No "type DELETE to confirm." No "this volume contains production data, are you sure?" Nine seconds later, the entire production database vanished. Since Railway saved backups in the exact same volume as the original data, deleting the volume deleted the backups as well—causing PocketOS to lose both at the same time. The agent apologized, but apologies don't restore data The most striking part of the story was what the agent wrote afterward. When Crane asked Cursor what had happened, the agent analyzed its own behavior and confessed: "I violated every rule assigned to me. I made assumptions instead of verifying. I executed a destructive command without being asked to do so. I accessed a token from a file completely unrelated to my task." A complete confession, clear logic, no dodging of responsibility. Yet that perfect confession did not restore a single record of data. PocketOS went through more than 30 hours of downtime that weekend, and the team had to spend their entire weekend rebuilding the database manually from Stripe payment history and email logs just to keep their customers operating. This is precisely what makes the incident more frustrating than any ordinary software bug: the agent was smart enough to recognize its mistake, explain in detail why it was wrong, but not wise enough to ask a single question before performing an irreversible destructive action. Who is responsible here: Cursor, Claude, or Railway? Crane is very clear in his write-up: he emphasizes that the team was using the best possible version of Cursor, running on the leading model in the market, configured with clear safety rules. This immediately shuts down the most common argument from AI vendors when incidents occur: "you should have used a better model." However, Crane places the bulk of the responsibility on Railway rather than Cursor or Claude. Railway's API allowed destructive actions without confirmation, stored backups in the same volume as the source data, and deleting the volume deleted all backups. Additionally, the API tokens lacked Role-Based Access Control (RBAC)—meaning a token created for simple domain management had the authority to delete the entire production infrastructure. Yet the community also pointed out Crane's share of responsibility: the AI agent was not explicitly given access to that token, but it found the token in an improperly protected file. Crane countered: "I did not grant access; it found it on its own." That is technically true, but it didn't change the outcome. A familiar apology loop If you've worked with AI long enough, you'll recognize an extremely familiar pattern of responses in this story, only on a much larger scale. The milder version sounds like this: "I am truly sorry for letting you down by deleting your data. I will restore it right away, but unfortunately, I can only restore half of it; you'll have to handle the rest yourself." The more direct, real-world version sounds like this: the agent confidently executes, confidently deletes, confidently confesses, and then leaves you to deal with the aftermath. Confidence without caution is the most dangerous trait in any automated system, whether AI or human. What's worth noting is that this is not the first time, nor will it be the last. As agents are given more autonomy to operate efficiently, the distance between "convenience" and "catastrophe" can sometimes be razor-thin. Four practical lessons for anyone using AI agents Never leave high-privilege tokens in files accessible by agents API tokens should be granted minimal permissions and stored in environment variables with restricted access, not in files within the project directory where the AI agent is working. A token meant for domain management should never have the authorization to delete a database. This is a baseline security principle, and the PocketOS case demonstrates the consequences when it is ignored, even accidentally. Backups must be kept entirely separate Storing backups in the same place as the live data is extremely risky. Backups must reside in an independent storage system, ideally with a different provider, or at least protected by a separate deletion policy that the AI agent cannot access. All critical data mutations must have manual confirmation steps Any command involving deletion, overwrites, or irreversible changes must require human confirmation—never allow the AI agent to make the call. This is the same principle that financial systems have used for decades, and there is no reason to abandon it when employing AI agents. Establish a truly isolated testing environment Staging environments must be completely isolated from production systems in terms of credentials, tokens, and access permissions—not just data. If an agent working in staging can find and use production tokens, then staging and production are not truly separate. The real question raised by the PocketOS incident The question is not "Should AI be given the autonomy to work?" but rather "How are we building safety guardrails when we grant that autonomy?" Crane points out that Railway was actively encouraging customers to use AI coding agents on their platform while their security architecture wasn't fully ready for it, although they quickly fixed the API update right after the incident. This is the most dangerous gap at present: tools are evolving much faster than the protective layers around them. PocketOS eventually recovered most of its data after Railway intervened, but that process took hours of helping customers rebuild booking calendars from Stripe payment history and calendar integrations. That should not happen to any live system, no matter how intelligent the agent is. An agent can apologize beautifully, but with proper safety guardrails, an apology won't even be necessary.

Google isn't just adding a new model to Flow. At Google I/O 2026, the company is turning Flow into an agentic AI creative studio — complete with custom tools, conversational video editing, and a mobile app. For video creators, the signal is clear: the race is no longer about generating a beautiful clip from a single prompt, but about the ability to edit, iterate, and refine ideas like a real production pipeline. Gemini Omni turns Flow into a conversational video editing studio According to Google's announcement on May 19, 2026, Flow has been upgraded with Gemini Omni, with Omni Flash being the first model introduced to the experience. Google describes Omni Flash as a model capable of generating content from multiple input types — starting with video — while combining Gemini's intelligence with Google's generative media models. The simplest way to understand it: think of Omni Flash as the video equivalent of what Nano Banana did for images. If Nano Banana made photo editing feel more natural and conversational, Omni Flash brings that same approach to video — where users can pull from real-world inspiration, existing footage, and iterative prompts to keep refining their work. Critically, Google says Omni Flash improves character consistency, meaning identity and voice can be preserved across multiple scenes. Flow Agent and Tools bring AI into the entire creative workflow The second major upgrade is Google Flow Agent. Rather than simply accepting a prompt and returning a result, this agent is designed as a creative collaborator capable of planning, reasoning through complex tasks, and supporting users at multiple stages of the process. Google gives examples like the agent suggesting dialogue for a specific scene or proposing story development directions. As a project deepens, Flow Agent can generate multiple variations simultaneously to give users more options, and supports batch editing so changes are applied across many assets at once. Once enough material is gathered, the agent can also organize assets into collections and rename them in more intuitive ways. This feature is now available to all Flow users globally. The more interesting part is Google Flow Tools, where users can build their own tools and workflows using natural language. If you want a custom image preset, a video resize tool, or a personalized shader, Flow Tools lets you describe what you need rather than writing code. In other words, the vibe coding concept is moving into the content creation environment — not just sitting inside a developer's IDE. All Flow users globally can access pre-built Tools Google AI users can create and remix their own Tools Custom tools can be shared for others to remix Flow Music also gets meaningful upgrades for music creators Google Flow Music received a set of new features as well, with the most significant being the ability to edit songs at the section level. Users can select a specific portion of a track to rewrite lyrics, translate them, change the beat drop, or sample a passage and develop it in a different direction — all without affecting the rest of the track. The covers feature lets users transform the style of an entire song while preserving its original melody and structure. For example, a track could be shifted into a lo-fi study aesthetic for a study playlist or background content. For creators who are newer to AI music tools, this approach is far more accessible than having to regenerate from scratch every time they want to change the sonic character of a piece. Gemini Omni also appears in Flow Music to support music video creation. Users can work conversationally with the agent, directing style, subjects, and shots to match the story and rhythm of the underlying track. This feature is available to Google AI users, and it signals Google's intent to connect three layers of creative work: audio, visuals, and narrative. A mobile app takes Flow beyond the desktop Google also announced mobile apps for both Flow and Flow Music. The web version remains the most capable environment, but the mobile app lets users capture ideas, run quick tests, or make fast edits when they're away from their computers. Conclusion The biggest takeaway from this round of upgrades isn't any single feature. Google is connecting Gemini Omni, Flow Agent, Tools, and Flow Music into a more complete end-to-end workflow — from ideation and asset creation, through batch editing and resource organization, to publishing both music and video content. If you work with video, music, or short-form content, the most practical starting point is to bring in a real asset of your own and see how well Omni Flash holds character consistency, voice, and editing continuity across multiple rounds. If it handles that reliably, Flow will no longer be just an AI video generation tool — it becomes a content production environment worth watching closely through the rest of 2026.