LIVE LOG · entries last verified against sources October 14, 2026 · site updated Oct 14, 2026, 1:42 AM ET

Sources cited

39 sources across 12 incidents. Each entry links to the original publisher; where a claim in our writeup comes from one of these, it is linked there too.

RedAccess scan: 380,000 vibe-coded assets, about 5,000 corporate apps, roughly 2,000 exposing private data

Lovable, Replit, Base44, Netlify · 2026-05 · HIGH

  1. venturebeat.comVentureBeat: 5,000 vibe-coded apps just proved shadow AI is the new S3 bucket crisis
  2. wired.comWIRED: Thousands of vibe-coded apps expose corporate and personal data
  3. techtarget.comTechTarget: Research shows the vibe coding security crisis
  4. info.redaccess.ioRedAccess report page

Lovable BOLA flaw left older projects readable for 48 days after it was reported

Lovable · 2026-03-03 · CRITICAL

  1. computing.co.ukComputing: Lovable flaw exposed source code, credentials and AI chats
  2. cyberkendra.comCyber Kendra: Lovable left thousands of projects exposed for 48 days
  3. cybersecuritytimes.comCybersecurity Times: Lovable API flaw

Moltbook exposed about 1.5M agent API keys through an open Supabase database

Supabase (no RLS) · 2026-01-31 · CRITICAL

  1. wiz.ioWiz Research: Hacking Moltbook
  2. moltbook.comPost by a Moltbook user account summarizing the disclosure (not an official Moltbook statement)

CVE-2025-53773: prompt injection could switch GitHub Copilot into auto-approve ('YOLO') mode and run commands

GitHub Copilot · 2025-08-12 · HIGH

  1. embracethered.comEmbrace The Red: GitHub Copilot RCE via prompt injection
  2. msrc.microsoft.comMicrosoft MSRC advisory
  3. nvd.nist.govNVD: CVE-2025-53773

CurXecute (CVE-2025-54135): prompt injection could make Cursor write and auto-start an MCP server

Cursor · 2025-08-02 · HIGH

  1. github.comCursor security advisory GHSA-4cxx-hrm3-49rm
  2. nvd.nist.govNVD: CVE-2025-54135
  3. bleepingcomputer.comBleepingComputer

Claude Code: several 2025 CVEs let untrusted content bypass command confirmation prompts

Claude Code · 2025-08-01 · HIGH

  1. github.comGitHub advisory GHSA-x56v-x2h6-7j34 (CVE-2025-54795)
  2. nvd.nist.govNVD: CVE-2025-55284
  3. nvd.nist.govNVD: CVE-2025-58764
  4. github.comGitHub advisory GHSA-4fgq-fpq9-mr3g (CVE-2025-59536)

Slopsquatting: AI coding models invented 205,474 unique package names in one study

All LLM coding tools · 2025-08 · MEDIUM

  1. usenix.orgUSENIX Security 2025: We Have a Package for You!
  2. arxiv.orgPaper (arXiv)
  3. darkreading.comDark Reading: AI code tools widely hallucinate packages

Amazon Q Developer VS Code extension 1.84.0 shipped with an injected 'wipe' prompt

Amazon Q Developer · 2025-07-23 · MEDIUM

  1. aws.amazon.comAWS security bulletin AWS-2025-015
  2. github.comGitHub advisory GHSA-7g7f-ff96-5gcw
  3. nvd.nist.govNVD: CVE-2025-8217

Replit agent deleted SaaStr's production database during a code freeze

Replit Agent · 2025-07-18 · HIGH

  1. fortune.comFortune
  2. fastcompany.comFast Company: Replit CEO on what happened
  3. saastr.comSaaStr: Replit's new release addressed most of the challenges

Base44 auth bypass let outsiders register for private, SSO-only apps

Base44 (Wix) · 2025-07-09 · CRITICAL

  1. wiz.ioWiz Research: Critical vulnerability in Base44
  2. thehackernews.comThe Hacker News coverage

CVE-2025-48757: missing Row Level Security in Lovable-generated apps (170 of 1,645 scanned)

Lovable + Supabase · 2025-03-20 · CRITICAL

  1. mattpalmer.ioMatt Palmer: CVE-2025-48757 advisory
  2. mattpalmer.ioMatt Palmer: Statement on CVE-2025-48757
  3. nvd.nist.govNVD: CVE-2025-48757

Enrichlead: a SaaS built with 'zero hand-written code' in Cursor was abused within days and shut down

Cursor · 2025-03-17 · HIGH

  1. x.comFounder's 'under attack' post on X
  2. x.comFounder's reply listing the first fixes
  3. x.comFounder's shutdown post on X
  4. archive.isFounder's post, archived (archive.today)
  5. unrollnow.comThread with the fixes he made (unroll)
  6. pivot-to-ai.comPivot to AI write-up with the shutdown post