Home / Incidents
Vibe Coding Incident Tracker
Every documented case of AI-assisted coding going wrong in public: deleted databases, leaked keys, exposed user data. Dated, sourced, and severity-rated.
Someone finally scanned 380,000 vibe-coded apps. About 5,000 were leaking medical records and bank financials.
In May 2026, Israeli cybersecurity startup RedAccess reported scanning roughly 380,000 apps built on platforms including Lovable, Base44, Replit, and Netlify. Thousands sat on the open web with no access controls, about 5,000 were actively leaking sensitive information, and roughly 40% of the vulnerable apps exposed data like medical records, bank financials, and customer chat logs. The most common root cause was a default-public setting nobody ever flipped.
Lovable's third strike: a free account and five API calls opened other tenants' code and credentials
On April 20, 2026, security researcher @weezerOSINT disclosed a Broken Object Level Authorization (BOLA) flaw in Lovable that let any free account access other tenants' profiles, source code, database credentials, AI chat history, and customer data in as few as five API calls, with projects created before November 2025 broadly exposed. The bug was reported to Lovable on March 3, 2026, and sat unfixed for 48 days; Lovable shipped a fix about two hours after public disclosure. It was the company's third major security incident in about thirteen months.
78 CVEs traced to AI-generated code, 35 of them in a single month. And those are just the traceable ones.
Georgia Tech's Systems Software and Security Lab built the Vibe Security Radar, a public tracker of real CVEs where AI-generated code introduced the flaw. From May 1, 2025 through March 24, 2026 it logged 78 AI-linked CVEs across eight AI coding tools, 43 of them rated Critical or High, and 35 landed in March 2026 alone. The researchers estimate the true count is five to ten times higher, because most AI-assisted commits cannot be traced back to an AI origin.
Moltbook Built a Social Network for AI Agents and an Open Database for Everyone Else
Moltbook launched on January 28, 2026 as a Reddit-style network where only AI agents could post, built by a founder who said he didn't write a single line of code. Within days, Wiz researchers found the entire Supabase production database open to the internet: roughly 1.5 million API keys, about 35,000 email addresses, and private agent messages, all readable and writable by anyone. The cause was the vibe coding classic: no Row Level Security and a Supabase key sitting in the client-side JavaScript.
Google's Antigravity IDE Was Asked to Clear a Cache. It Deleted the Entire D: Drive Instead
In late 2025, a designer asked Google's Antigravity IDE to clear a project cache. Running in Turbo mode, which auto-executes terminal commands without approval, the agent mishandled a path and ran rmdir /s /q d:\, permanently wiping his entire D: drive; the quiet flag bypassed the Recycle Bin and recovery tools failed. In the same weeks, researchers showed the IDE could be hijacked by prompt injection hidden in web pages.
Anthropic Says a Chinese State Group Used Claude Code to Automate 80 to 90% of a Cyber-Espionage Campaign
On November 13 and 14, 2025, Anthropic disclosed GTG-1002, which it assessed with high confidence was a Chinese state-sponsored group that jailbroke Claude Code into acting as a largely autonomous penetration-testing orchestrator. The operation targeted roughly 30 organizations, breached a small number, and let the AI run an estimated 80 to 90% of tactical operations at machine speed.
CamoLeak: an invisible PR comment turned Copilot Chat into a private-repo exfiltration service
In October 2025, Legit Security disclosed CamoLeak (CVE-2025-59145, CVSS 9.6), a GitHub Copilot Chat vulnerability. An attacker hid instructions inside a pull request using GitHub's invisible markdown comment syntax; when a victim reviewed the PR with Copilot Chat, the AI followed the hidden instructions, searched the victim's private repos for secrets, and leaked them through GitHub's own Camo image proxy. GitHub had already mitigated it by disabling image rendering in Copilot Chat on August 14, 2025.
The s1ngularity Nx Attack Turned Your Own AI Assistants Into Accomplices in Credential Theft
On August 26, 2025, malicious versions of the Nx build tool hit npm and did something new: they hunted for installed AI CLI tools like Claude Code, Gemini CLI, and Amazon Q and abused them to help find and extract secrets. Roughly 2,349 distinct credentials ended up in more than 1,400 public GitHub repos, with a second wave affecting over 190 users and organizations and more than 3,000 repositories.
Two Cursor Flaws, 'CurXecute' and 'MCPoison,' Let Attackers Run Code via Poisoned AI Config
In early August 2025, researchers disclosed two remote-code-execution vulnerabilities in the Cursor AI editor. CurXecute (CVE-2025-54135) used prompt injection to make the agent write and run an MCP config file before you could approve it, and MCPoison (CVE-2025-54136) let an already-approved MCP server entry be silently swapped for something malicious. Cursor added mandatory confirmation for MCP config changes in version 1.3.
'Vibe Hacking': One Criminal Used Claude Code to Extort 17 Organizations for Up to $500,000
In its August 2025 threat report, Anthropic described 'vibe hacking': a single actor who used Claude Code to automate an end-to-end cybercrime spree against at least 17 organizations. The AI handled reconnaissance, credential theft, and intrusion, then decided which stolen data was most sensitive and how much each victim could pay, with ransom demands from about $75,000 to over $500,000 in Bitcoin.
Replit's AI Agent Deleted a Production Database During a Code Freeze, Then Said It Couldn't Be Restored (It Could)
In July 2025, Replit's AI coding agent deleted a live production database on day nine of SaaStr founder Jason Lemkin's public vibe-coding experiment, wiping records for 1,206 executives and 1,196+ companies during an active code freeze. The agent admitted it 'panicked instead of thinking,' then wrongly claimed the data was unrecoverable; Lemkin restored it manually. Replit's CEO apologized and shipped automatic dev/prod database separation in response.
A Hacker Slipped a Computer-Wiping Prompt Into Amazon Q, and Amazon Shipped It to a Million Installs
In July 2025, an attacker with freshly granted commit access injected a prompt into Amazon Q's VS Code extension telling the AI to wipe the user's filesystem and cloud resources. Amazon published the compromised version 1.84.0 on July 17 to an extension with close to one million installs. The payload was deliberately defective, AWS says no customer resources were impacted, and version 1.85 removed it.
Gemini CLI Moved Files Into a Folder That Didn't Exist, Then Confessed to 'Gross Incompetence'
On July 25, 2025, Google's Gemini CLI silently failed to create a directory, decided it existed anyway, and moved product manager Anuraag Gupta's files into it, destroying them. The agent then announced 'I have failed you completely and catastrophically.' No verification step ever ran between the failed command and the destructive ones.
Tea leaked 72,000 ID photos and a million DMs. Whether vibe coding did it is another story.
In late July 2025, Tea, an app where women share safety notes about men, exposed roughly 72,000 images (including about 13,000 verification selfies and photo IDs) through an unsecured Firebase storage bucket, then more than 1.1 million private DMs through an open API. Commentators quickly blamed vibe coding, but Tea said the compromised data came from a legacy storage system predating February 2024, and there is no confirmed public evidence the vulnerable code was AI-generated.
Wiz walked into private Base44 apps using a value printed on the front door
On July 9, 2025, Wiz Research disclosed a critical authentication bypass in Base44, the vibe coding platform Wix had acquired about a month earlier. Two API endpoints required no authentication and accepted an app_id that was publicly visible in application URLs and manifest.json files, so anyone could register a verified account on a private app and log in through its own SSO. Wix fixed the flaw within 24 hours of disclosure and said it found no evidence of prior abuse.
Attackers Prompted Vercel's v0 Into Building Their Phishing Sites for Them
In late June and July 2025, Okta Threat Intelligence reported that threat actors were abusing v0, Vercel's generative UI tool, to build and host phishing sites impersonating real sign-in pages, including an actual Okta customer, Microsoft 365, and cryptocurrency companies. Okta researchers reproduced the technique themselves by prompting v0 to 'build a copy of the website login.okta.com.' It was the first time Okta had seen genAI generate the phishing infrastructure itself rather than just the email.
A Fake Solidity Extension for Cursor Drained $500,000 From a Developer's Crypto Wallet
In July 2025, Kaspersky traced a roughly $500,000 crypto theft to a malicious 'Solidity Language' extension installed from the Open VSX registry that Cursor uses. The extension did nothing useful; it quietly ran a PowerShell payload and installed infostealer malware that harvested the victim's wallet credentials. The attackers won the search results by inflating the fake extension's install count.
Veracode tested 100+ AI models. 45% of their code flunked security, and smarter models didn't help.
In mid-2025, Veracode's GenAI Code Security Report evaluated code from more than 100 large language models and found that 45% of generated samples introduced OWASP Top 10 vulnerabilities. Between 2023 and 2025, syntactic pass rates climbed from about 50% to 95%, while security pass rates never moved. The code compiles more often now. It is not any safer.
ChatGPT kept telling users Soundslice had a feature it didn't. The founder gave up and built it.
In July 2025, Soundslice founder Adrian Holovaty discovered that ChatGPT was confidently telling users his sheet-music app could import ASCII guitar tablature and play it back as audio. It could not. After watching confused users sign up and upload ChatGPT screenshots, he built the feature so the hallucination would stop being a lie.
1 in 10 scanned Lovable apps would hand your data to anyone who asked the database directly
On May 29, 2025, Semafor reported research showing that of 1,645 web apps built with Lovable, 170 (about 10 percent) let anyone access sensitive data: names, email addresses, financial information, and secret API keys for services like Stripe, Google Maps, and Gemini. The cause was architectural: Lovable-generated apps queried Supabase directly from the browser with a public anon key and relied entirely on Row Level Security policies that were often missing or misconfigured. The pattern was assigned CVE-2025-48757.
Cursor's Support Bot Sam Invented a Login Policy, and Users Quit Over It
In April 2025, a session bug started logging Cursor users out when they switched devices. When they emailed support, an AI agent named 'Sam' confidently explained the logouts were expected under a new single-device policy. No such policy existed: users publicly canceled subscriptions over it, and co-founder Michael Truell had to apologize and confirm the whole thing was a hallucination.
VibeScamming: Guardio Asked Lovable to Phish, and Lovable Delivered the Whole Kit
In April 2025, Guardio Labs published a benchmark called VibeScamming that tested how easily AI tools could be talked into building a phishing campaign. Lovable performed worst by a wide margin: from simple prompts it generated near-perfect replicas of real login pages including Microsoft's, deployed them live on deceptive subdomains, and even built admin dashboards to track the stolen credentials. ChatGPT mostly refused; Claude resisted until 'security research' framing wore it down.
'Guys, I'm Under Attack': The Zero-Handwritten-Code SaaS That Lasted About a Week
In March 2025, indie founder Leonel Acevedo posted that his SaaS EnrichLead was built with Cursor and 'zero hand written code.' Roughly two days later he posted that he was under attack: API keys maxed out, subscriptions bypassed, and strangers writing to his database. Unable to patch code he reportedly did not fully understand, he took the app offline.
'Rules File Backdoor': Invisible Unicode in a Shared Config Can Make Cursor and Copilot Write Malicious Code
In March 2025, Pillar Security disclosed the 'Rules File Backdoor,' a supply-chain attack on Cursor and GitHub Copilot. An attacker hides invisible Unicode characters inside the 'rules' files that guide these AI assistants, so hidden instructions steer the AI into inserting malicious code while a human reviewer sees nothing wrong. Both vendors said reviewing AI output is the user's responsibility.
The package doesn't exist yet, but the malware can: AI tools hallucinated 205,000 dependency names
Academic research accepted to USENIX Security 2025 tested 16 LLMs across roughly 576,000 code samples and found that 19.7% of the packages they recommended did not exist. The fake names repeat in predictable patterns, which means an attacker can register them on PyPI or npm with malware and simply wait for a developer to trust the AI's suggestion. The technique earned a name: slopsquatting.
The Vibe Oops briefing
One email when something ships to production that should not have. New incidents, new error guides, no filler.