VibeIncidents Newshttps://vibeincidents.com/news/Sourced news on vibe-coding and AI coding tool security.enPluto Security comes out of stealth with $42M to watch what employees build with AIhttps://vibeincidents.com/news/#n0vi-news-2026-10-13-0Tue, 13 Oct 2026 12:00:00 -0400Another sign that security budgets are moving to AI tools, MCP servers and the apps employees ship with them. Pluto says it monitors those components and agent activity in real time. Source: https://techcrunch.com/2026/10/13/pluto-security-raises-42m-as-ai-gives-enterprise-security-teams-a-new-headache/Rein Security raises a $25M Series A for runtime controls on AI agentshttps://vibeincidents.com/news/#n1vi-news-2026-10-08-1Thu, 08 Oct 2026 12:00:00 -0400Rein's pitch is guardrails at the moment an agent acts, not after. Total funding is now $35M, per the company and Calcalist. Source: https://reinsec.io/blog/series-a/SusVibes benchmark: coding agents wrote working code far more often than secure codehttps://vibeincidents.com/news/#n2vi-news-2026-09-21-2Mon, 21 Sep 2026 12:00:00 -0400On 186 real-world tasks, SWE-Agent with Claude 4 Sonnet got 57% functionally correct but only 11.8% secure. Adding vulnerability hints to the prompt barely helped. These are benchmark results, not production breach rates. Source: https://www.alphaxiv.org/abs/2512.03262Study audits 200 live vibe-coded apps and finds at least one vulnerability in 91%https://vibeincidents.com/news/#n3vi-news-2026-09-14-3Mon, 14 Sep 2026 12:00:00 -0400Researchers collected 9,041 open-source apps built with Claude Code and Lovable and audited 200 deployed ones, finding 1,186 vulnerabilities, mostly broken access control, injection and auth failures. Better prompting reduced them but did not remove them. Source: https://www.alphaxiv.org/abs/2606.23130Lovable adds Workspace Insights for Enterprise adminshttps://vibeincidents.com/news/#n4vi-news-2026-06-23-4Tue, 23 Jun 2026 12:00:00 -0400Admins get one view of every project with publish status, security findings and PII findings, plus filters for abandoned and ownerless projects. That targets the shadow-app problem RedAccess described. Source: https://lovable.dev/blog/workspace-insights-govern-your-workspaceLovable now runs a security scan automatically before every publishhttps://vibeincidents.com/news/#n5vi-news-2026-06-01-5Mon, 01 Jun 2026 12:00:00 -0400The quick scan checks database config, missing RLS policies and authorization gaps in about 10 to 15 seconds, and admins can block publishing on critical findings. Lovable says it does not replace a full security review. Source: https://lovable.dev/blog/how-lovable-protects-your-apps-automaticallyCapsule Security discloses hidden-instruction attacks on Cursor's agent; Cursor treats them as out of scopehttps://vibeincidents.com/news/#n6vi-news-2026-04-29-6Wed, 29 Apr 2026 12:00:00 -0400Capsule says invisible instructions in files or cloned repos could make the agent act with the developer's local access and carry over to other projects. Cursor closed the report as Informative, citing its program's prompt-injection exclusion. Source: https://www.capsulesecurity.io/blog-post/cursechain