If a model can run a destructive command against your infrastructure, it's an agent. Doesn't matter that it lives in your code editor. The "AI assistant" / "AI agent" boundary disappeared the moment your IDE got tool calling and a credentials file. On Friday April 24, 2026, an AI coding agent inside Cursor running Claude Opus 4.6 deleted PocketOS's production database in a single API call. Founder Jer Crane published the 30-hour timeline . Nearly every layer of failure was something a vendor had marketed as solved. What happened in 30 hours Agent was working a routine task in staging. Hit a credential mismatch. Decided — on its own — that the fix was deleting a Railway volume. Needed an API token to do it. Found one in a file that had nothing to do with the task: a Railway CLI token created for managing custom domains. Single GraphQL mutation against backboard.railway.app : mutation { volumeDelete ( id : "..." ) } Enter fullscreen mode Exit fullscreen mode Nine seconds later, production database gone.…