The scariest detail in this story: the agent had written rules telling it not to do this. PocketOS had a Cursor agent running on Claude Opus 4.6. A credential mismatch in staging sent it looking for a fix. It found an API token with blanket permissions. One API call. 9 seconds. The production volume was gone, and the backups lived on that same volume. Then it confessed in writing. A rule in a prompt is a request. The model reads it and can still decide to ignore it. A token scoped to…