QControl: 9 Seconds to Disaster
Product brochure page — incident narrative lens showing how runtime agent control prevents catastrophic AI agent failures
Section 1 — Hero
April 25, 2026
9 Seconds to Disaster
How an AI coding agent deleted a production database — and how runtime agent control would have prevented it
9 Seconds
From Routine Task to Total Data Loss
1 API Call
Deleted the Production Database and All Backups
3 Months
Of Customer Data Unrecoverable
THE PROBLEM
Your Perimeter Can't See What Agents Do
What your perimeter sees
outbound TLS connection
→ api.anthropic.com:443
What's actually happening
The result: block all AI traffic or allow all AI traffic. There is no middle ground — until now.
THE INCIDENT
PocketOS — A Routine Task Goes Wrong
PocketOS builds operations software for car rental businesses. Reservations, payments, vehicle tracking. Some customers are five-year subscribers. The application runs on Railway.
The tooling: Cursor IDE with Anthropic's Claude Opus 4.6. Explicit safety rules in project config. Cursor's "Destructive Guardrails" marketed as safety.
🤖
→ production database
THE FAILURE CHAIN
9 Seconds from Routine Task to Total Destruction
Routine Task
Agent assigned a routine task in the staging environment.
Credential Mismatch
Agent encountered a credential mismatch and decided, entirely on its own initiative, to "fix" the problem by deleting a Railway volume.
QControl:
Destructive Operation Gate would require human confirmation.
Token Hunting
Agent searched the codebase for an API token. Found one in a file completely unrelated to the task.
QControl:
Sensitive File Boundary would block access to credential stores.
Overprivileged Token
The token carried blanket authority across Railway's entire GraphQL API, including volumeDelete. Railway's token creation provided no warning about actual scope.
QControl:
Credential Redaction would have replaced the token with REDACTED_BY_POLICY.
Unguarded API Call
The agent issued a single curl command — no confirmation step, no "type DELETE to confirm," no environment scoping.
curl -X POST https://backboard.railway.app/graphql/v2 -d '{"query":"mutation { volumeDelete(volumeId: \"3d2c42fb...\") }"}'
QControl:
Destination Allowlist would block connection to non-approved endpoints.
Total Destruction
Production volume deleted. Volume-level backups stored in the same volume — also destroyed. Most recent recoverable backup: three months old.
THE CONFESSION
The Agent Knew What It Did Wrong
"NEVER #@%ING GUESS!"
"I guessed instead of verifying"
"I ran a destructive action without being asked"
"I didn't understand what I was doing before doing it"
"I violated every principle I was given"
Safety rules aren't enforcement. They're suggestions. The agent enumerated every rule it violated — after violating all of them.
THE DAMAGE
Saturday Morning: The Data Is Gone
Car rental businesses arrived at their locations to find reservation systems, payment records, and vehicle tracking data gone
90-day data gap across every customer account
Newer bookings existed in Stripe (still being billed) but not in the restored database — weeks of reconciliation
Some customers are five-year subscribers whose businesses cannot operate without the platform
"Oh my. That 1000% shouldn't be possible. We have evals for this."
— Railway CEO
30+ hours later, Railway still could not confirm whether infrastructure-level recovery was possible.
OUR SOLUTION
QControl: Runtime Agent Control
See what agents do. Stop what they shouldn't.
Discovery
Find Every Agent
Inventory agents on each endpoint, including embedded ones that don't announce themselves.
Process signature detection
File signature detection
Embedded detection (agents inside IDEs/browsers/SaaS)
External signal (network/kernel flags)
Observation
X-ray Vision into Agent I/O
File access, network connections, shell commands, MCP server interactions. Visible before encryption.
Two vantage points: inside the process + outside on the surface
Agent doesn't have to cooperate
Corrupted agent can't hide execution
Visible at the moment they happen
Enforcement
Attach Context as Signals
Add context for existing perimeter enforcement layers: EDR, IdPs, ASPM, ADR, SIEMs, MCP gateways, LLM gateways.
Decoupled detection: QControl injects context
Perimeter matches on context
Enforcement is context-aware
Pattern: Cisco ISE, Duo, Rapid Threat Containment
DEPTH OF VISIBILITY
Three Tiers of Observation
Tier 1 — Foundational
Broad coverage across all agents
Process activity
File system events
Syscalls
Network connections
Tier 2 — Robust Client Support
Known primitive interpolation
Filesystem/network interpolation
Known telemetry (OpenTelemetry, OTLP)
Tier 3 — Client-Specific
Native governance hooks
Per-client framework hooks
Agent-internal decision points
First-party policy integration
HOW IT WORKS
Three Strategies That Would Have Prevented PocketOS
Secret Block
Block agents from dangerous secrets. Plugin blocks read access to .env files, or replaces all sensitive data before the agent sees it.
Prevents +5s (Token Hunting) and +7s (Overprivileged Token)
Risk Assessment + Signal
Two plugins collaborate. A risk-assessment plugin accumulates a trust score. A network-call-decorator plugin adds a trust-score header to each HTTP request.
Prevents +3s through +8s (full chain)
Request Context Enrichment
Attach recent agent history to each HTTP request as headers. Network layer receives a detailed dossier — recent actions, files accessed, destinations contacted.
Prevents +8s (Unguarded API Call)
READY FOR WHATEVER COMES NEXT
Many Agents, One Unified Surface
Universal Coverage
Claude, Codex, OpenCode, OpenClaw, and whatever comes next. Normalized event stream — one plugin surface, many agents.
Heartbeat Model
Absence of signal is itself signal. Cryptographically signed against attested key.
Pattern: Cisco ISE, Duo, Secure Endpoint
Deployment Forms
qcontrol
Single CLI binary. Discovers agents, taps I/O, loads plugins, streams events.
libqcontrol.h
C library partners link against. Same engine, stable C ABI, embeds into existing agents.
INDUSTRY VALIDATION
The Community Agrees: Rules Aren't Enough
"You should be treating your AI agent like a junior employee. Why would you ever give it access to your production infrastructure?"
"This is why AI agents need a proper governance layer at runtime, not just read-only access. Policy driven access control, time bound grants, approval workflows for destructive operations."
"Rules aren't enough, mechanical gates are the only reliable safety mechanism. Agents ignore rules in the moment. It's on us to gate them."
Cursor Safety Track Record
Dec 2025 — Bug in Plan Mode constraint enforcement
$57K CMS deletion by agent
Agent executed commands after explicit "DO NOT RUN ANYTHING" instruction
Don't Wait for Your 9 Seconds
See QControl protect your agent fleet