LIVE LOG · entries last verified against sources October 14, 2026 · site updated Oct 14, 2026, 1:42 AM ET
LATEST
HIGHCVE-2025-53773: prompt injection could switch GitHub Copilot into auto-approve…added Oct 14, 12:16 AM ETHIGHClaude Code: several 2025 CVEs let untrusted content bypass command confirmati…added Oct 14, 12:16 AM ETMEDIUMSlopsquatting: AI coding models invented 205,474 unique package names in one s…added Oct 14, 12:16 AM ETHIGHEnrichlead: a SaaS built with 'zero hand-written code' in Cursor was abused wi…added Oct 14, 12:16 AM ETHIGHRedAccess scan: 380,000 vibe-coded assets, about 5,000 corporate apps, roughly…added Oct 13, 11:49 PM ET
Threat log / vibe-coded software

Incidents in AI-built software, rated and sourced.

What broke, how it happened, and how to check your own app. Severity is our call; the method is on the methodology page.

12Incidents logged →
4Rated critical →
39Sources cited →
1.5MKeys exposed, Moltbook →
28.65MSecrets leaked on GitHub, 2025 →

Log

Severity
Type
Dateto
SeverityIncidentDate
HIGHRedAccess scan: 380,000 vibe-coded assets, about 5,000 corporate apps, roughly 2,000 exposing private data
Research Lovable, Replit, Base44, Netlify
2026-05
CRITICALLovable BOLA flaw left older projects readable for 48 days after it was reported
Vulnerability Lovable
2026-03-03
CRITICALMoltbook exposed about 1.5M agent API keys through an open Supabase database
Incident Supabase (no RLS)
2026-01-31
HIGHCVE-2025-53773: prompt injection could switch GitHub Copilot into auto-approve ('YOLO') mode and run commands
Vulnerability GitHub Copilot
2025-08-12
HIGHCurXecute (CVE-2025-54135): prompt injection could make Cursor write and auto-start an MCP server
Vulnerability Cursor
2025-08-02
HIGHClaude Code: several 2025 CVEs let untrusted content bypass command confirmation prompts
Vulnerability Claude Code
2025-08-01
MEDIUMSlopsquatting: AI coding models invented 205,474 unique package names in one study
Research All LLM coding tools
2025-08
MEDIUMAmazon Q Developer VS Code extension 1.84.0 shipped with an injected 'wipe' prompt
Incident Amazon Q Developer
2025-07-23
HIGHReplit agent deleted SaaStr's production database during a code freeze
Incident Replit Agent
2025-07-18
CRITICALBase44 auth bypass let outsiders register for private, SSO-only apps
Vulnerability Base44 (Wix)
2025-07-09
CRITICALCVE-2025-48757: missing Row Level Security in Lovable-generated apps (170 of 1,645 scanned)
Vulnerability Lovable + Supabase
2025-03-20
HIGHEnrichlead: a SaaS built with 'zero hand-written code' in Cursor was abused within days and shut down
Incident Cursor
2025-03-17

No entries match these filters.

Types: Incident A real-world event in a production system: data exposed, abused or destroyed. · Vulnerability A disclosed flaw or CVE in a tool or platform. Exploitation may or may not have happened. · Research A study or scan that measures a problem across many apps or models.
The date in the log is the main date for each entry. Each entry page lists the incident, disclosure, added and last-verified dates separately. Machine-readable index: /incidents.json