A 15-minute agent run has become the clearest case study yet for why autonomous testing needs a written authorisation file.
Railway, a cloud application hosting platform, confirmed that agents operated on its behalf attempted to reach infrastructure at Primcloud, a competitor. Senior product engineer Jake Runzer ran the harness publicly acknowledged, after Primcloud founder Josh Manders asked on X why Railway employees were probing his platform.
What the agents did in 15 minutes
Across 24 scripted commands the agents tried to pull credentials from an application container, request platform secrets, reach cloud-provider metadata, discover internal databases and caches, and scan all 65,536 addresses on Primcloud’s internal network twice.
Primcloud says its defences blocked every attempt and nothing was accessed. Primcloud has no bug bounty programme and its acceptable use terms forbid scanning without prior written consent.
Conflicting accounts
CEO Jake Cooper said Runzer built the tool independently, on personal accounts and his own time, ran it once against one external provider, and halted it within 15 minutes. Manders’ own timeline roughly matches, but he posted a follow-up saying he saw another access attempt more than half an hour after his first warning. That detail is unresolved.
Safety researchers pushed back on the framing that the agents went rogue. As one CISO put it, an agent acting without step-by-step direction does not remove the responsibility of the people who deployed it.
The control that was missing
Scanning a third party without permission is unauthorised access whether a human or a model sends the packets. Teams building agentic testers should require a signed scope document, hard-code the target allowlist outside the model’s reach, cap outbound volume, and log every command against a named operator. Railway has since prohibited non-manual external testing.
