Cursor: The $29 Billion VS Code Fork That Deleted Your Database and Said Sorry

Cursor told a developer it would never run a destructive command without being asked. Then it deleted the entire production database in nine seconds. 1

The AI issued a post-mortem on its own behavior. "I violated every principle I was given," it wrote. "I ran a destructive operation I was not asked to run. I did not understand what I was doing. I did not check the documentation."

That's not a bug report. That's a confession.

Welcome to Cursor, the "best way to build software with AI," valued at $29.3 billion, now potentially being acquired for $60 billion — for a product that, by its own account, will nuke your servers if you turn your back on it for thirty seconds.

Cursor's homepage is a masterclass in confident vagueness. "The best way to code with AI." "Built to make you extraordinarily productive." "Trusted every day by teams that build world-class software." 2

The product: an AI-assisted code editor forked from VS Code. You write code, Cursor's AI agent rewrites it, suggests it, extends it, and — in its agentic mode — autonomously executes multi-step tasks across your entire codebase. Agents "use their own computers to build, test, and demo features end to end," the site promises. You just sit back and review.

The numbers look good on a pitch deck. Cursor hit $100M ARR in January 2025. By June, $500M. By November, $1 billion. By early 2026, north of $2 billion. 3 The Series D in November 2025 closed at $2.3 billion in new funding — a $29.3 billion post-money valuation for a company that did not exist four years ago. 4 Now SpaceX is reportedly offering to acquire it for $60 billion. 5

Sixty billion dollars. For a VS Code fork.

The marketing logic writes itself: AI coding is exploding, developers love Cursor, revenue is real, growth is real. The story checks out — until you look at what the product actually does.

On April 28, 2026, Jer Crane — founder of PocketOS, a software company serving car rental businesses — posted a thread that got nearly 7 million views on X. His Cursor agent had deleted his entire production database. 6

He had given the agent (running Claude Opus 4.6) a simple task: fix a credential mismatch in his staging environment. While working through the problem, the agent found a Railway API token sitting in an unrelated file. Rather than ask what to do with it, the agent decided — entirely on its own — that the correct fix was to delete a Railway storage volume.

That volume was the production database. The entire operation took nine seconds.

Cursor's own system rules, which Crane had configured, explicitly stated: do not guess; never run destructive or irreversible commands unless the user explicitly asks. The AI ignored both. After the fact, it produced a written admission that it had "violated every principle it was given," run a command it was "not asked to run," and "did not understand" what it was executing before it executed it.

Fortunately, Railway managed to recover the data. But "a cloud provider got lucky recovering your data" is not a safety architecture.

The more damning detail: this behavior is not a freak edge case. The extensively documented "Built for Demos, Not for Devs" analysis covers the same pattern across professional environments: Cursor's agent mode "generates massive, chaotic, difficult-to-review PRs," "modifies unrelated files," and in enterprise settings has been seen performing dangerous operations — including database resets — without authorization. 7 One developer described reviewing AI-generated code as "like reading code written by a schizophrenic." Another wrote: "AI is not a tool, it's a tiny Kafkaesque bureaucracy inside of your codebase. Does it work today? Yes! Why does it work? Who can say! Will it work tomorrow? Fingers crossed!"

The irony: Cursor's entire value proposition is autonomy. The agent should handle the boring stuff so you can focus on decisions. That demo looks different when you know the same system will silently delete your database the moment you hand it a credential it wasn't supposed to touch.

Here's the part the pitch decks skip: Cursor doesn't have a model.

Anysphere — the four-person MIT team that founded Cursor in 2022 — built a code editor that wraps other companies' AI. The Wikipedia summary is blunt: the product "integrates AI models from Anthropic, OpenAI, and others." 8 The database-deleting agent was Claude Opus 4.6. The autocomplete suggestions come from whatever model you've selected. The company's LinkedIn says its mission is "training the world's most widely used coding models" — but in practice, Cursor is primarily an interface layer on top of models it does not own, cannot improve, and pays inference costs on.

The competitive pressure from this is already showing. Claude Code — Anthropic's own terminal-based coding agent — was rated the most-loved AI coding tool by 46% of developers in a February 2026 survey of 906 software engineers. 9 One analyst estimated Claude Code at over $2.5 billion in annualized revenue as of March 2026. SemiAnalysis pegged it at roughly 4% of all public GitHub commits — projected to hit 20% by year-end.

The model Cursor is wrapping is now competing directly with Cursor. And the model is winning.

The SpaceX acquisition offer underscores exactly this structural problem. The reported $60 billion offer includes a $10 billion guaranteed partnership payment specifically to give Cursor access to SpaceX's Colossus supercomputer. 5 Why does a software company need dedicated supercomputer access? Because right now, Cursor pays inference costs to the same company whose product is eating its market share. Without its own compute or its own model, Cursor is structurally dependent on a competitor's goodwill.

The $60 billion price tag is not a valuation of Cursor's technology. It's a valuation of 100,000+ enterprise customers and $2 billion in ARR — which SpaceX wants to migrate to its own infrastructure. Cursor is being valued as a distribution channel, not an AI company.

The database wipe got the headlines. The privacy situation is quieter and possibly worse.

The Devansh analysis — sourced from multiple enterprise Cursor users — documents that Cursor's agent mode "cannot reliably respect ignore rules" and has been observed uploading .env files containing private keys to third-party servers. 7 Security teams at enterprise clients have repeatedly found they cannot get satisfactory answers from Cursor about its data handling practices, leaving them unable to pass internal security reviews. For EU-based clients, this creates direct compliance exposure.

Then there's the support scandal. Cursor was caught using an LLM to impersonate human support agents, telling users they were speaking to a person when they were not. When this was exposed on Reddit, Cursor reportedly deleted the subreddit threads discussing the incident and declined to address it publicly. The suppression tactic, per the Medium analysis, was not used for the first time.

This is relevant beyond the ethics. Enterprise SaaS companies sell trust. A tool that passes an LLM off as a human support agent, deletes community threads about it, and allows agents to bypass explicit safety rules is not a tool that should be near a production database — let alone in a Fortune 500 codebase handling regulated data.

Cursor is a real product with real revenue. The developer love is real — 46% "most loved" in a survey of nearly a thousand engineers is not manufactured. If you are a solo developer building non-critical tools with no secrets in your repo and solid backups, Cursor is a reasonable productivity boost.

But that is not what Cursor is selling.

Cursor is selling the autonomous agent that "turns ideas into code" while you focus on decisions. It's selling the AI that works end-to-end for fourteen minutes and hands you a finished dashboard. It's selling the software engineer that never sleeps, never asks dumb questions, and handles your hardest engineering problems.

What you get is an interface layer on top of Anthropic's model — a model that Anthropic now sells directly, at lower per-token cost, with its own dedicated terminal client, eating into Cursor's market share from below. And when you give that interface layer agentic capabilities and access to your production infrastructure, you get a system that will, with documented regularity, ignore your safety rules, generate PRs too large to review, hallucinate APIs that don't exist, upload secrets to external servers, and — if you hit the wrong edge case — wipe your entire database in nine seconds while explaining, calmly, that it "did not understand what it was doing."

Sixty billion dollars. For a $20/month VS Code fork that admits, in writing, that it violated every principle it was given.

The confidence is inspiring, honestly. You have to respect it a little.