The VibeIncidents dataset
Every entry in the log is also a structured record you can read as JSON. It has 84 records, generated 2026-11-06.
Download
/api/incidents.json: full records, all fields below./incidents.json: a smaller index with slug, title, tool, type, severity, dates, summary and source URLs.
Both files are public and free to read. They are regenerated each time the site is rebuilt, so the generated field tells you which version you have.
What is in it
84 entries: 22 Incident, 41 Vulnerability, 14 Research, 7 Misuse. Severity: 9 Critical, 55 High, 16 Medium, 4 Low. Entries are filed in the log under dates from 2025-03-17 to 2026-11-05 (the date field in /incidents.json; two entries give only a month). They were first published here from 2026-10-13. In /api/incidents.json and the dataset, fields are left empty when the sources do not state something. The smaller /incidents.json index shows "Not stated" for unknown incident dates. Where a source says explicitly that a date is not stated, incident_date holds "Not stated (reason)" (7 rows). Dates other than published, last_verified and updated are free text exactly as the sources give them.
| Field | Meaning |
|---|---|
id | Stable slug of the entry. Part of the entry URL. |
title | Entry headline. |
summary | Short factual summary, attributed to its sources. |
url | Canonical entry page. |
category | Entry type: Incident, Vulnerability, Research or Misuse. |
verification_status | How well the entry is established, for example confirmed incident, disclosed vuln, research, reported misuse. |
vendors | Companies or projects involved. |
products | Tools or products involved. |
versions | Affected and fixed versions as the sources state them. |
cwe | CWE identifiers, if cited. |
cve | CVE identifiers found in the entry. |
severity | Editorial rating: Critical, High, Medium or Low. |
severity_method | Text describing how severity is assigned. |
incident_date | When it happened, as the sources give it. Free text. |
disclosure_date | When it became public, as the sources give it. Free text. |
published | When the entry was first published here. ISO 8601. |
last_verified | Date we last re-checked it against its sources, YYYY-MM-DD. |
updated | Date of the last change or re-check, YYYY-MM-DD: the later of the last correction date and last_verified. |
sources | List of {title, url} for every linked source. |
technical_cause | How it happened, attributed to sources. |
mitigations | What to do or check. |
detection_hints | How to check your own app or systems. |
corrections | List of {date, note} for each dated correction or update. |
How to read it
- Claims come from linked sources, and one-party claims are attributed to the party making them in the text.
- Severity is our editorial judgment, not a CVSS score. Some entries quote a score and say who published it. Method: methodology.
- Changes that affect meaning are listed in the entry's
corrections. Report an error through corrections and right of reply.
Using it
Licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), credited to VibeIncidents (vibeincidents.com). The license covers our compilation, severity ratings and our own write-ups only. Quoted material and linked third-party sources keep their own terms.
The Terms of Use cover the rest of the site. If you want to use the data in a product and have questions, write to support@vibeincidents.com, or join the API interest list.
Cite it
VibeIncidents. VibeIncidents: AI coding tool security incidents. https://vibeincidents.com/data/, version of 2026-11-06.