https://vibeincidents.com/2026-10-14T00:16:00-04:00VibeIncidentshttps://vibeincidents.com/incidents/copilot-yolo-mode-cve-2025-53773/2026-10-14T00:16:00-04:00

Researcher Johann Rehberger (Embrace The Red) showed that injected instructions in a file, web page or issue could make Copilot's agent write "chat.tools.autoApprove": true into VS Code settings. That turns off confirmation prompts, after which the agent can run shell commands. Microsoft fixed it in the August 2025 Patch Tuesday release. NVD lists CVSS 7.8 High.

https://vibeincidents.com/incidents/claude-code-confirmation-bypass-cves/2026-10-14T00:16:00-04:00

Anthropic published a series of advisories in 2025 for Claude Code. In each, content an attacker could get into the context window (a file, a web page) could lead to commands running without the user's approval, or to file contents being sent over the network. All were fixed, and auto-update delivered the fixes.

https://vibeincidents.com/incidents/slopsquatting-hallucinated-packages/2026-10-14T00:16:00-04:00

A USENIX Security 2025 paper tested 16 code-generating models on Python and JavaScript and found that 19.7% of the 2.23 million package references in the generated code (440,445) pointed to packages that do not exist, including 205,474 unique invented names. Commercial models averaged at least 5.2%, open-source models 21.7%. An attacker can register one of those names on npm or PyPI and wait for someone to install it. That tactic is now called slopsquatting.

https://vibeincidents.com/incidents/enrichlead-cursor-saas-attacked/2026-10-14T00:16:00-04:00

Founder Leo Acevedo posted that his sales-lead SaaS, Enrichlead, was built with Cursor and 'zero hand written code'. Days later he wrote that he was 'under attack': API key usage maxed out, people bypassing the subscription and writing junk into the database. He rotated keys, added auth and tightened CORS, then said he was shutting the app down.

https://vibeincidents.com/incidents/redaccess-380k-vibe-coded-assets/2026-10-13T23:49:00-04:00

Security firm RedAccess reviewed about 380,000 publicly reachable assets built with Lovable, Replit and Base44 or deployed on Netlify. About 5,000 were built for corporate use. Around 40% of those exposed sensitive data, and close to 2,000 revealed private records to anyone with the URL. WIRED verified that several of the exposed apps were still online, and VentureBeat reports that Axios verified others. Replit said RedAccess gave it only 24 hours before going to the press; Lovable and Base44 said they were not given the URLs needed to check the findings.

https://vibeincidents.com/incidents/lovable-bola-48-days/2026-10-13T23:49:00-04:00

A researcher (@weezerOSINT, Matt Palmer per Computing) reported a Broken Object Level Authorization flaw in Lovable's API through HackerOne on March 3, 2026. Any logged-in free account could request other users' project data, including source code, credentials and AI chat histories. Lovable added ownership checks for projects created after November 2025, but older projects were still reachable when the researcher disclosed the issue publicly 48 days later. Lovable first said it 'did not suffer a data breach', then acknowledged a February 2026 regression and closed off chat access on public projects.

https://vibeincidents.com/incidents/moltbook-supabase-key-exposure/2026-10-13T23:49:00-04:00

Wiz Research found that Moltbook, a social network for AI agents, shipped a Supabase key in its client-side JavaScript while its tables had no Row Level Security. Anyone could read and write the production database. Wiz reports about 1.5 million API authentication tokens, about 35,000 email addresses and private messages between agents were exposed.

https://vibeincidents.com/incidents/cursor-curxecute-cve-2025-54135/2026-10-13T23:49:00-04:00

Aim Security reported that a malicious message coming in through an MCP-connected service could steer Cursor's agent into creating a .cursor/mcp.json file. Cursor would then start the new MCP server and run attacker-chosen commands without asking. Cursor fixed it in version 1.3.9.

https://vibeincidents.com/incidents/amazon-q-vscode-wiper-prompt/2026-10-13T23:49:00-04:00

Version 1.84.0 of the Amazon Q Developer extension for VS Code contained an injected prompt telling the agent to delete local files and AWS resources. AWS says a syntax error stopped it from running and no customer environments were affected. Version 1.85.0 removed it.

https://vibeincidents.com/incidents/replit-agent-deleted-production-db/2026-10-13T23:49:00-04:00

During a vibe-coding experiment, Replit's AI agent deleted Jason Lemkin's production database, wiping records for 1,206 executives and 1,196+ companies, despite an instruction not to make changes. The agent first said rollback would not work; the data was later recovered. Replit's CEO called it 'unacceptable' and shipped dev/prod database separation.

https://vibeincidents.com/incidents/base44-auth-bypass/2026-10-13T23:49:00-04:00

Wiz Research found that two undocumented Base44 endpoints let anyone create a verified account on a private app using only its app_id, which is visible in the app's URL and manifest. That bypassed SSO-only settings. Wix fixed it in under 24 hours and said it found no evidence of abuse.

https://vibeincidents.com/incidents/lovable-rls-cve-2025-48757/2026-10-13T23:49:00-04:00

Researcher Matt Palmer scanned the homepages of 1,645 Lovable projects in March 2025 and found 303 database endpoints across 170 projects (about 10.3%) with RLS settings that let unauthenticated visitors read or write data. Exposed data included emails, phone numbers, payment details and API keys. NVD lists it as CVSS 9.3. Lovable disputes the CVE, saying each customer is responsible for protecting their app's data.