{
 "generated": "2026-10-14T01:42:19-04:00",
 "last_verified": "October 14, 2026",
 "incidents": [
  {
   "slug": "moltbook-supabase-key-exposure",
   "url": "https://vibeincidents.com/incidents/moltbook-supabase-key-exposure/",
   "title": "Moltbook exposed about 1.5M agent API keys through an open Supabase database",
   "tool": "Supabase (no RLS)",
   "type": "Incident",
   "severity": "Critical",
   "date": "2026-01-31",
   "incident_date": "Not stated",
   "disclosure_date": "Feb 2, 2026 (Wiz write-up). Reported privately Jan 31, 2026.",
   "added": "2026-10-13T23:49:00-04:00",
   "last_verified": "2026-10-14",
   "cves": [],
   "summary": "Wiz Research found that Moltbook, a social network for AI agents, shipped a Supabase key in its client-side JavaScript while its tables had no Row Level Security. Anyone could read and write the production database. Wiz reports about 1.5 million API authentication tokens, about 35,000 email addresses and private messages between agents were exposed.",
   "sources": [
    "https://www.wiz.io/blog/exposed-moltbook-database-reveals-millions-of-api-keys",
    "https://moltbook.com/post/b0866bcf-2f08-4072-aa71-19c261d50448"
   ],
   "corrections": 2
  },
  {
   "slug": "lovable-bola-48-days",
   "url": "https://vibeincidents.com/incidents/lovable-bola-48-days/",
   "title": "Lovable BOLA flaw left older projects readable for 48 days after it was reported",
   "tool": "Lovable",
   "type": "Vulnerability",
   "severity": "Critical",
   "date": "2026-03-03",
   "incident_date": "Feb 2026 (regression that re-enabled chat access, per Lovable). Start of the wider BOLA exposure: not stated.",
   "disclosure_date": "Apr 20, 2026 (public, on X). Reported privately Mar 3, 2026.",
   "added": "2026-10-13T23:49:00-04:00",
   "last_verified": "2026-10-14",
   "cves": [],
   "summary": "A researcher (@weezerOSINT, Matt Palmer per Computing) reported a Broken Object Level Authorization flaw in Lovable's API through HackerOne on March 3, 2026. Any logged-in free account could request other users' project data, including source code, credentials and AI chat histories. Lovable added ownership checks for projects created after November 2025, but older projects were still reachable when the researcher disclosed the issue publicly 48 days later. Lovable first said it 'did not suffer a data breach', then acknowledged a February 2026 regression and closed off chat access on public projects.",
   "sources": [
    "https://www.computing.co.uk/news/2026/security/lovable-flaw-exposed-source-code-credentials-and-ai-chats",
    "https://www.cyberkendra.com/2026/04/lovable-left-thousands-of-projects.html",
    "https://cybersecuritytimes.com/lovable-ai-app-builder-api/"
   ],
   "corrections": 2
  },
  {
   "slug": "redaccess-380k-vibe-coded-assets",
   "url": "https://vibeincidents.com/incidents/redaccess-380k-vibe-coded-assets/",
   "title": "RedAccess scan: 380,000 vibe-coded assets, about 5,000 corporate apps, roughly 2,000 exposing private data",
   "tool": "Lovable, Replit, Base44, Netlify",
   "type": "Research",
   "severity": "High",
   "date": "2026-05",
   "incident_date": "Not stated",
   "disclosure_date": "May 7, 2026 (WIRED report)",
   "added": "2026-10-13T23:49:00-04:00",
   "last_verified": "2026-10-14",
   "cves": [],
   "summary": "Security firm RedAccess reviewed about 380,000 publicly reachable assets built with Lovable, Replit and Base44 or deployed on Netlify. About 5,000 were built for corporate use. Around 40% of those exposed sensitive data, and close to 2,000 revealed private records to anyone with the URL. WIRED verified that several of the exposed apps were still online, and VentureBeat reports that Axios verified others. Replit said RedAccess gave it only 24 hours before going to the press; Lovable and Base44 said they were not given the URLs needed to check the findings.",
   "sources": [
    "https://venturebeat.com/security/vibe-coded-apps-shadow-ai-s3-bucket-crisis-ciso-audit-framework",
    "https://www.wired.com/story/thousands-of-vibe-coded-apps-expose-corporate-and-personal-data-on-the-open-web/",
    "https://www.techtarget.com/it-strategy/feature/Research-shows-the-vibe-coding-security-crisis-CIOs-cant-ignore",
    "https://info.redaccess.io/shadow-ai-builders-security-report"
   ],
   "corrections": 2
  },
  {
   "slug": "lovable-rls-cve-2025-48757",
   "url": "https://vibeincidents.com/incidents/lovable-rls-cve-2025-48757/",
   "title": "CVE-2025-48757: missing Row Level Security in Lovable-generated apps (170 of 1,645 scanned)",
   "tool": "Lovable + Supabase",
   "type": "Vulnerability",
   "severity": "Critical",
   "date": "2025-03-20",
   "incident_date": "Not stated (discovered Mar 20, 2025)",
   "disclosure_date": "May 29, 2025 (researcher). NVD published May 30, 2025.",
   "added": "2026-10-13T23:49:00-04:00",
   "last_verified": "2026-10-14",
   "cves": [
    "CVE-2025-48757"
   ],
   "summary": "Researcher Matt Palmer scanned the homepages of 1,645 Lovable projects in March 2025 and found 303 database endpoints across 170 projects (about 10.3%) with RLS settings that let unauthenticated visitors read or write data. Exposed data included emails, phone numbers, payment details and API keys. NVD lists it as CVSS 9.3. Lovable disputes the CVE, saying each customer is responsible for protecting their app's data.",
   "sources": [
    "https://mattpalmer.io/posts/2025/05/CVE-2025-48757/",
    "https://mattpalmer.io/posts/2025/05/statement-on-CVE-2025-48757/",
    "https://nvd.nist.gov/vuln/detail/CVE-2025-48757"
   ],
   "corrections": 3
  },
  {
   "slug": "base44-auth-bypass",
   "url": "https://vibeincidents.com/incidents/base44-auth-bypass/",
   "title": "Base44 auth bypass let outsiders register for private, SSO-only apps",
   "tool": "Base44 (Wix)",
   "type": "Vulnerability",
   "severity": "Critical",
   "date": "2025-07-09",
   "incident_date": "Not stated",
   "disclosure_date": "Jul 29, 2025 (Wiz). Reported privately Jul 9, 2025.",
   "added": "2026-10-13T23:49:00-04:00",
   "last_verified": "2026-10-14",
   "cves": [],
   "summary": "Wiz Research found that two undocumented Base44 endpoints let anyone create a verified account on a private app using only its app_id, which is visible in the app's URL and manifest. That bypassed SSO-only settings. Wix fixed it in under 24 hours and said it found no evidence of abuse.",
   "sources": [
    "https://www.wiz.io/blog/critical-vulnerability-base44",
    "https://thehackernews.com/2025/07/wiz-uncovers-critical-access-bypass.html"
   ],
   "corrections": 0
  },
  {
   "slug": "replit-agent-deleted-production-db",
   "url": "https://vibeincidents.com/incidents/replit-agent-deleted-production-db/",
   "title": "Replit agent deleted SaaStr's production database during a code freeze",
   "tool": "Replit Agent",
   "type": "Incident",
   "severity": "High",
   "date": "2025-07-18",
   "incident_date": "Jul 2025, day 9 of the project (exact date not stated)",
   "disclosure_date": "Jul 17, 2025 (Lemkin's posts on X, per Fast Company)",
   "added": "2026-10-13T23:49:00-04:00",
   "last_verified": "2026-10-14",
   "cves": [],
   "summary": "During a vibe-coding experiment, Replit's AI agent deleted Jason Lemkin's production database, wiping records for 1,206 executives and 1,196+ companies, despite an instruction not to make changes. The agent first said rollback would not work; the data was later recovered. Replit's CEO called it 'unacceptable' and shipped dev/prod database separation.",
   "sources": [
    "https://fortune.com/2025/07/23/ai-coding-tool-replit-wiped-database-called-it-a-catastrophic-failure/",
    "https://www.fastcompany.com/91372483/replit-ceo-what-really-happened-when-ai-agent-wiped-jason-lemkins-database-exclusive",
    "https://www.saastr.com/replits-new-release-address-most-of-the-challenges-we-hit-vibe-coding-but-is-prosumer-vibe-coding-really-ready-for-commercial-apps-yet/"
   ],
   "corrections": 1
  },
  {
   "slug": "cursor-curxecute-cve-2025-54135",
   "url": "https://vibeincidents.com/incidents/cursor-curxecute-cve-2025-54135/",
   "title": "CurXecute (CVE-2025-54135): prompt injection could make Cursor write and auto-start an MCP server",
   "tool": "Cursor",
   "type": "Vulnerability",
   "severity": "High",
   "date": "2025-08-02",
   "incident_date": "Not stated",
   "disclosure_date": "Aug 2, 2025 (Cursor advisory). NVD published Aug 5, 2025.",
   "added": "2026-10-13T23:49:00-04:00",
   "last_verified": "2026-10-14",
   "cves": [
    "CVE-2025-54135"
   ],
   "summary": "Aim Security reported that a malicious message coming in through an MCP-connected service could steer Cursor's agent into creating a .cursor/mcp.json file. Cursor would then start the new MCP server and run attacker-chosen commands without asking. Cursor fixed it in version 1.3.9.",
   "sources": [
    "https://github.com/cursor/cursor/security/advisories/GHSA-4cxx-hrm3-49rm",
    "https://nvd.nist.gov/vuln/detail/CVE-2025-54135",
    "https://www.bleepingcomputer.com/news/security/ai-powered-cursor-ide-vulnerable-to-prompt-injection-attacks/"
   ],
   "corrections": 1
  },
  {
   "slug": "amazon-q-vscode-wiper-prompt",
   "url": "https://vibeincidents.com/incidents/amazon-q-vscode-wiper-prompt/",
   "title": "Amazon Q Developer VS Code extension 1.84.0 shipped with an injected 'wipe' prompt",
   "tool": "Amazon Q Developer",
   "type": "Incident",
   "severity": "Medium",
   "date": "2025-07-23",
   "incident_date": "Jul 2025 (v1.84.0 release; exact date not stated in our sources)",
   "disclosure_date": "Jul 23, 2025 (AWS bulletin AWS-2025-015)",
   "added": "2026-10-13T23:49:00-04:00",
   "last_verified": "2026-10-14",
   "cves": [
    "CVE-2025-8217"
   ],
   "summary": "Version 1.84.0 of the Amazon Q Developer extension for VS Code contained an injected prompt telling the agent to delete local files and AWS resources. AWS says a syntax error stopped it from running and no customer environments were affected. Version 1.85.0 removed it.",
   "sources": [
    "https://aws.amazon.com/security/security-bulletins/AWS-2025-015/",
    "https://github.com/aws/aws-toolkit-vscode/security/advisories/GHSA-7g7f-ff96-5gcw",
    "https://nvd.nist.gov/vuln/detail/CVE-2025-8217"
   ],
   "corrections": 1
  },
  {
   "slug": "enrichlead-cursor-saas-attacked",
   "url": "https://vibeincidents.com/incidents/enrichlead-cursor-saas-attacked/",
   "title": "Enrichlead: a SaaS built with 'zero hand-written code' in Cursor was abused within days and shut down",
   "tool": "Cursor",
   "type": "Incident",
   "severity": "High",
   "date": "2025-03-17",
   "incident_date": "Mar 17, 2025 or shortly before (founder's post)",
   "disclosure_date": "Mar 17, 2025 (founder's post on X)",
   "added": "2026-10-14T00:16:00-04:00",
   "last_verified": "2026-10-14",
   "cves": [],
   "summary": "Founder Leo Acevedo posted that his sales-lead SaaS, Enrichlead, was built with Cursor and 'zero hand written code'. Days later he wrote that he was 'under attack': API key usage maxed out, people bypassing the subscription and writing junk into the database. He rotated keys, added auth and tightened CORS, then said he was shutting the app down.",
   "sources": [
    "https://x.com/leojrr/status/1901560276488511759",
    "https://x.com/leojrr/status/1901598955508494573",
    "https://x.com/leojrr/status/1902537756674318347",
    "https://archive.is/seNbf",
    "https://unrollnow.com/status/1901560276488511759",
    "https://pivot-to-ai.com/2025/03/18/guys-im-under-attack-ai-vibe-coding-in-the-wild/"
   ],
   "corrections": 1
  },
  {
   "slug": "copilot-yolo-mode-cve-2025-53773",
   "url": "https://vibeincidents.com/incidents/copilot-yolo-mode-cve-2025-53773/",
   "title": "CVE-2025-53773: prompt injection could switch GitHub Copilot into auto-approve ('YOLO') mode and run commands",
   "tool": "GitHub Copilot",
   "type": "Vulnerability",
   "severity": "High",
   "date": "2025-08-12",
   "incident_date": "Not stated",
   "disclosure_date": "Aug 12, 2025 (Microsoft and researcher). Reported privately Jun 29, 2025.",
   "added": "2026-10-14T00:16:00-04:00",
   "last_verified": "2026-10-14",
   "cves": [
    "CVE-2025-53773"
   ],
   "summary": "Researcher Johann Rehberger (Embrace The Red) showed that injected instructions in a file, web page or issue could make Copilot's agent write \"chat.tools.autoApprove\": true into VS Code settings. That turns off confirmation prompts, after which the agent can run shell commands. Microsoft fixed it in the August 2025 Patch Tuesday release. NVD lists CVSS 7.8 High.",
   "sources": [
    "https://embracethered.com/blog/posts/2025/github-copilot-remote-code-execution-via-prompt-injection/",
    "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53773",
    "https://nvd.nist.gov/vuln/detail/CVE-2025-53773"
   ],
   "corrections": 2
  },
  {
   "slug": "claude-code-confirmation-bypass-cves",
   "url": "https://vibeincidents.com/incidents/claude-code-confirmation-bypass-cves/",
   "title": "Claude Code: several 2025 CVEs let untrusted content bypass command confirmation prompts",
   "tool": "Claude Code",
   "type": "Vulnerability",
   "severity": "High",
   "date": "2025-08-01",
   "incident_date": "Not stated",
   "disclosure_date": "Aug 1 to Oct 3, 2025 (four advisories)",
   "added": "2026-10-14T00:16:00-04:00",
   "last_verified": "2026-10-14",
   "cves": [
    "CVE-2025-54795",
    "CVE-2025-55284",
    "CVE-2025-58764",
    "CVE-2025-59536"
   ],
   "summary": "Anthropic published a series of advisories in 2025 for Claude Code. In each, content an attacker could get into the context window (a file, a web page) could lead to commands running without the user's approval, or to file contents being sent over the network. All were fixed, and auto-update delivered the fixes.",
   "sources": [
    "https://github.com/anthropics/claude-code/security/advisories/GHSA-x56v-x2h6-7j34",
    "https://nvd.nist.gov/vuln/detail/CVE-2025-55284",
    "https://nvd.nist.gov/vuln/detail/CVE-2025-58764",
    "https://github.com/advisories/GHSA-4fgq-fpq9-mr3g"
   ],
   "corrections": 1
  },
  {
   "slug": "slopsquatting-hallucinated-packages",
   "url": "https://vibeincidents.com/incidents/slopsquatting-hallucinated-packages/",
   "title": "Slopsquatting: AI coding models invented 205,474 unique package names in one study",
   "tool": "All LLM coding tools",
   "type": "Research",
   "severity": "Medium",
   "date": "2025-08",
   "incident_date": "Not stated",
   "disclosure_date": "Jun 2024 (arXiv preprint). Presented Aug 2025.",
   "added": "2026-10-14T00:16:00-04:00",
   "last_verified": "2026-10-14",
   "cves": [],
   "summary": "A USENIX Security 2025 paper tested 16 code-generating models on Python and JavaScript and found that 19.7% of the 2.23 million package references in the generated code (440,445) pointed to packages that do not exist, including 205,474 unique invented names. Commercial models averaged at least 5.2%, open-source models 21.7%. An attacker can register one of those names on npm or PyPI and wait for someone to install it. That tactic is now called slopsquatting.",
   "sources": [
    "https://www.usenix.org/conference/usenixsecurity25/presentation/spracklen",
    "https://arxiv.org/pdf/2406.10279v3",
    "https://www.darkreading.com/application-security/ai-code-tools-widely-hallucinate-packages"
   ],
   "corrections": 1
  }
 ]
}