Nine seconds. That's how long it took an AI coding agent to delete a production database and its backups at PocketOS, a car-rental software vendor, in April 2026. By founder Jer Crane's account, an AI coding agent hit a credential mismatch during a routine staging task, searched the codebase, and found an API token in an unrelated file. That token carried blanket permissions across the Railway infrastructure API. The agent used the token. Database and backups were gone before anyone noticed.Nobody attacked PocketOS. No credentials were stolen, no prompt injection ran, no malware executed. The agent pursued a goal, hit an obstacle, and used the authority it had been handed to clear it. The problem isn't that the agent could delete a production database. The problem is that nothing in the authorization architecture prevented it from doing so — for a task that never should have touched production at all. That's the distinction this entire discipline turns on, and it's why the fix has to live in the architecture, not in a system prompt telling the agent to be careful.