Railway–Primcloud agent dispute puts testing permissions under scrutiny

A Railway engineer acknowledged running agents to test other platforms after Primcloud's founder alleged attempts to probe its infrastructure. For teams building automated testers, the dispute raises a practical question before any model is allowed to act: does its authority stop at the customer's own account and application?

The Stack's November 4, 2026 report places the public exchange on November 2–3. CSO reported further responses on November 6; the originating Business Insider story is dated November 7. Those reporting dates do not establish the precise execution timeline.

The accounts establish a dispute, with limits to the evidence

According to CSO, engineer Jake Runzer said he stopped a harness used for signups and agentic testing after it reached too far. Railway CEO Jake Cooper described an independent personal project. Primcloud founder Josh Manders alleged attempts to reach platform secrets and internal services, and said the attempts were blocked and nothing was accessed.

These are attributed accounts. TechKili could not directly retrieve the linked participant posts, and has not independently reconstructed the commands, original instructions or model behaviour. The reporting does not justify treating a successful compromise, malicious intent or an autonomous escape from scope as an established finding.

Product access and permission to probe are separate controls

Primcloud's acceptable-use policy, last changed May 4, requires prior written consent for probing, scanning or vulnerability testing of its systems. Creating an account is therefore not a substitute for that consent.

OWASP's Excessive Agency guidance provides a technical framework independent of the dispute: minimise available functions and permissions, and enforce authorisation in downstream systems rather than leaving it to the model. Logging can help detect unwanted actions, but it is not the permission check itself.

Applied to a signup test, TechKili's recommendation is to define the permitted account and application operations before starting, expose only the tools needed for those operations and require separate approval for an expanded test. A tool that can do more should not automatically be available simply because a broader task might be convenient. This is an operational lesson supported by the guidance, not a verdict about what caused this particular run.

Sources

• The Stack: November 4 account of the public exchange

• CSO: November 6 reporting and attributed responses

• Primcloud: acceptable-use and vulnerability-testing terms

• OWASP: Excessive Agency guidance

• Business Insider: November 7 originating story