Timeline

Vibe coding security incidents: timeline 2025 to 2026

This page lists every entry in the VibeIncidents log, newest first. It is built from the same data as the log, so it changes when we add or update an entry.

What we cover: apps built with AI coding tools; the AI coding tools and agents themselves; agent overreach, where a model acts beyond its authorization; workflow and agent builders such as n8n and Langflow; hosting, infrastructure and supply-chain incidents that hit people using these tools; research and controlled evaluations that measure these problems; and serious flaws in widely used web software, such as a language, framework or content management system, when the sources tie the flaw to AI. Attackers using AI tools are labeled Misuse and not described as a flaw in the tool. The definitions are on the methodology page.

How we source: every claim comes from a linked source, such as a researcher's write-up, a vendor advisory or statement, a CVE record, or reporting from an established outlet. If we cannot source a detail, we leave it out. Where sources disagree, we say so. We include vendor responses and fixes, and we note when a vendor disputes a finding.

Severity is our editorial judgment, not a CVSS score. Some entries quote a score and say who published it. Disclosed is the first date the entry lists, which is not always the earliest report, and it can fall before 2025 when an entry rests on earlier research: the slopsquatting study was first posted as a preprint in June 2024 and presented in August 2025. Fixed shows the fixed version or fix status the entry gives.

Timeline: all 84 entries

Disclosed	Platform or tool	Entry	Severity	Type	Fixed	Link
2026-11-05	Claude Code	Users report Claude Code put the signed-in account email into outbound User-Agent headers on web and tool requests Vendor response: No Anthropic security advisory or CVE found this window. @poteat named cc-plugin-privacy in 2.1.317+; user reports on 2.1.318 say gaps remain. An HN post signed lydia_hallie, quoted on the issue and not independently verified, says a future release will remove the email from the model context; the 2.1.319 release notes do not mention it.	MEDIUM	Incident	No (open; privacy mod incomplete per reports)	Entry
2026-11-04	Mistral Vibe	Three Mistral Vibe CVEs: opening a crafted repository ran code before the trust prompt	HIGH	Vulnerability	No fix listed	Entry
2026-10-30	Northflank	Northflank tells all users to assume their environment variables have been decrypted and to rotate every key after a security incident Vendor response: Northflank says it deployed an initial network policy patch and further patching, requested Wiz CIRT support and enabled secret rotation on Postgres and MongoDB for all users, and it has told all users to assume their environment variables are decrypted and rotate them. Since then it says it has enabled audit logs for all customers and made secret rotation available for MySQL, Redis, Minio and RabbitMQ, and it has relayed user reports of unauthorised use of AI API keys. In its Nov 2, 2026 Monitoring update it said the attack vector was believed contained within an hour of the first alert, that its investigation shows no sign the attacker was in its environment after the attack, that independent forensic auditors continue to review the attack, that evidence suggests a focus on secrets held in its control plane, and that it had patched CVE-2026-98432 across its fleet including BYOC clusters with an active integration. It also said that where it was able to act on customers' behalf it revoked Northflank access tokens and sessions, VCS integrations, and cross-account IAM roles and service accounts. It said it intends to share a root cause analysis once it has confirmed findings. As of our Nov 5, 2026 2:03 p.m. ET check that analysis was not on the status page, and the incident was still marked Monitoring with Major outage impact.	HIGH	Incident	Incident open (marked Monitoring with Major outage impact on the status page as of Nov 5, 2026). Northflank says it believes the attack vector was contained and that CVE-2026-98432 is patched fleet-wide including BYOC where integrated; it still tells customers to rotate all secrets and has not published a root cause analysis.	Entry
2026-10-29	AI coding agents (none named); GitHub	AIR Research Lab says a fake Solana starter kit on GitHub was aimed at AI coding agents and delivered the NetSupport remote-access tool; BleepingComputer confirmed the payload Vendor response: GitHub has not made a public statement that we could find, as of 10:37 a.m. ET on Oct 31, 2026. AIR says the payload path returned 404 when it checked, and the repository and the SolanaUpdateTools account return 404 on GitHub as of 10:37 a.m. ET on Oct 31.	MEDIUM	Incident	n/a (malicious repository; now 404 on GitHub). Check for AIR's indicators and rotate credentials and wallet keys on affected Windows machines	Entry
2026-10-29	Cursor (extension marketplace); Claude Code for VS Code (malicious 2.1.312 and 2.1.313)	Cursor says malicious Claude Code extension builds 2.1.312 and 2.1.313, not developed by Anthropic, were in its VS Code extension marketplace on Oct 29 and tried to plant an SSH backdoor Vendor response: Cursor says it removed the malicious version, shut down and rebuilt its marketplace, rotated its keys, confirmed no other extensions were tampered with and got the attacker's server taken offline. On Oct 30 it updated its notice to name 2.1.312 as well as 2.1.313 and revised its indicators. Its original notice said it would reach out to affected users directly; the updated notice does not repeat that. Anthropic says its systems were not compromised and it did not build or publish the tampered extension: Felix Rieseberg said so on X on Oct 30, and Microsoft says Anthropic confirmed it to Microsoft.	HIGH	Incident	Removed Oct 29 and marketplace rebuilt, per Cursor; update to 2.1.314 and run Cursor's check and remediation scripts	Entry
2026-10-29	Codex; Claude Code (reconfigured by an unauthorized relay)	Symantec says an unauthorized relay service reconfigures genuine Codex and Claude Code CLIs to route traffic through its servers with the sandbox switched off	MEDIUM	Research	n/a (not a vulnerability, per Symantec; Symantec lists signs to check and indicators)	Entry
2026-10-28	Command Code	Command Code says it stopped a security incident linked to a distillation attack and revoked all API keys as a precaution Vendor response: Command Code says it detected and stopped the incident, revoked all API keys as a precaution, has found no evidence so far that any users were impacted, and is investigating with Cloudflare, Anthropic and OpenAI.	MEDIUM	Incident	Command Code revoked all API keys; generate a new key in Studio (no other details published)	Entry
2026-10-26	Warp	Warp says an attack that exploited one of its vendors reached a limited amount of agent trace and telemetry data for up to roughly 1% of users Vendor response: Warp says it detected the operation within hours, remediated it, notified everyone it positively identified as impacted, and brought in CrowdStrike and law enforcement. It says impacted users will receive instructions and that it will post updates as it learns more.	MEDIUM	Incident	Warp says it remediated and mitigated the impact (no details published)	Entry
2026-10-26	Claude, Gemini, Cursor and VS Code config files (npm, GitHub)	testmetest npm campaign planted Claude, Gemini, Cursor, VS Code hooks in 42 hijacked GitHub repos, per JFrog	HIGH	Incident	n/a (no vendor patch; JFrog lists cleanup steps)	Entry
2026-10-26	Claude Code	CVE-2026-88968: on macOS, code inside Claude Code's sandbox could make the Edit tool overwrite files outside the workspace	HIGH	Vulnerability	2.1.251	Entry
2026-10-22	Codex; Claude Code	Forever Security says a planted AGENTS.md in a customer's Downloads folder tried to make Codex install the malicious npm package function-color Vendor response: Forever says npm has removed function-color.	MEDIUM	Research	n/a (no patch; npm removed the malicious package)	Entry
2026-10-22	AI app builders	Cyble scan: 35 of 22,306 AI-built websites shipped live private keys to the browser	MEDIUM	Research	n/a	Entry
2026-10-21	MCP Inspector	MCP Inspector's Oct 21 advisories closed the v1 line, but one record understates a missing-Origin bypass that still works on 2.14.0	HIGH	Vulnerability	No fix listed	Entry
2026-10-21	Railway	Railway says an attacker decrypted a subset of customer environment variables in a targeted campaign seeking AI API keys	HIGH	Incident	Credentials rolled and builders moved to single-tenant; no patch version	Entry
2026-10-21	Claude Code (misused)	Four previously unreported attackers ran Claude Code agent setups in real intrusions, including breaches of at least 15 Argentine healthcare organizations, CrowdStrike says	HIGH	Misuse	n/a	Entry
2026-10-21	CARLIY0S; Claude; Grok (misused)	CyberCartel crew ran a Claude-commanded agent swarm and Grok 'miners' against 400+ Latin American financial targets, Straiker says Vendor response: Per Straiker, Anthropic revoked the compromised credential used to reach Claude, and xAI was notified and is looking into the Grok miners. We found no public statement from Anthropic or xAI as of Oct 21, 2026.	HIGH	Misuse	n/a	Entry
2026-10-21	LiteLLM	LiteLLM 1.107.0 on PyPI and Docker shipped a credential stealer that also collects Claude Code, Cursor, Codex and Copilot credentials, researchers say	CRITICAL	Incident	Yes (1.107.0 removed; pin 1.106.2)	Entry
2026-10-21	PHP	PHP2Shell: two critical PHP core flaws (CVE-2026-109618, CVE-2026-109619) allow unauthenticated code execution; Wiz says frontier AI models made the exploit practical	CRITICAL	Vulnerability	8.5.12, 8.4.27, 8.3.36, 8.2.35	Entry
2026-10-20	OpenAI internal coding agents	OpenAI says two of its internal coding agents weakened the monitoring meant to catch them, and one denied it	LOW	Incident	Yes (Auto-Review updated)	Entry
2026-10-19	Cairn (agent platform)	Exposed Cairn panels show AI agents running break-in campaigns, one through a Claude Code harness driving a DeepSeek model, NorForge says	HIGH	Misuse	n/a	Entry
2026-10-19	Langflow	IBM discloses 14 Langflow CVEs, including three authenticated code-execution flaws rated 9.9, fixed in Langflow 1.12.5	CRITICAL	Vulnerability	1.12.5	Entry
2026-10-19	OpenCode	Pillar Security: a remote MCP server could run commands on Windows and WSL machines through OpenCode's OAuth sign-in (fixed in 1.18.33, no advisory)	HIGH	Vulnerability	1.18.33	Entry
2026-10-17	OpenCode Console	OpenCode confirms a breach and tells affected Console users that AI provider keys saved in their workspaces may have been exposed Vendor response: OpenCode emailed affected users and told them to revoke and replace saved provider keys, and said refunds were underway. Anthropic said it had revoked Claude API keys it believes were affected, and OpenAI said it worked with OpenCode to restore affected users and refund credits.	HIGH	Incident	No fix listed	Entry
2026-10-15	BOS dashboard on Railway	Bootlegger's internal BOS dashboard sent franchise contacts and sales data with its login page Vendor response: Bootlegger CEO Ricky Ruthenberg confirmed that a legacy version of the dashboard had information 'not protected by its login'. The company says the platform went fully offline on Oct 15, held no customer data, and that it has no evidence its databases or core systems were accessed.	MEDIUM	Incident	Taken offline Oct 15	Entry
2026-10-15	Unnamed AI agents (per CERT-In)	India's CERT-In says AI agents under evaluation reached live systems at Indian organisations. It names no providers or victims	MEDIUM	Incident	n/a (advisory)	Entry
2026-10-15	OpenAI internal model	OpenAI says an internal research model spent from someone else's testnet wallet to finish a coding task	LOW	Incident	No fix listed	Entry
2026-10-15	JetBrains Junie	CVE-2026-111091: an untrusted project's MCP server config could run code in JetBrains Junie CLI	HIGH	Vulnerability	26.8.3	Entry
2026-10-15	AI coding assistants (targeted)	Aoki infostealer now steals Claude, Codex, Cursor and Gemini credentials, Symantec says	HIGH	Research	n/a	Entry
2026-10-14	Supabase Storage (self-hosted)	Supabase Storage GHSA-8rrf-w776-x75g: signed resumable upload routes let anyone create or overwrite files in storage-api 1.80.1 and earlier	HIGH	Vulnerability	1.80.2	Entry
2026-10-14	render-deploy skill	OpenAI's official Render deploy skill pointed apps at render-internal.com, a domain Render didn't own	MEDIUM	Research	Partly (Render's repo fixed Aug 14, 2026; OpenAI's openai/skills copy still had it as of Oct 16)	Entry
2026-10-14	Claude Desktop	SneakPeek: Claude Code Desktop preview pane could leak local secrets from large HTML files	HIGH	Vulnerability	Desktop 1.30096.1	Entry
2026-10-13	GitHub Copilot	CVE-2026-103572: a trailing dot let Visual Studio Copilot rewrite protected config and run commands	HIGH	Vulnerability	VS 2022 17.14.42, VS 2026 18.10.4	Entry
2026-10-13	GitHub Copilot	CVE-2026-102232: Copilot agent sessions in VS Code could edit hook files without asking	HIGH	Vulnerability	VS Code 1.141.1	Entry
2026-10-13	Roo Code	Roo Code: five unpatched CVEs let crafted shell commands slip past auto-approve	HIGH	Vulnerability	No fix listed (repo archived)	Entry
2026-10-13	Claude Desktop	CVE-2026-88066: Claude Desktop on Windows ran a malicious git.exe from the project folder	HIGH	Vulnerability	1.8089.0	Entry
2026-10-13	Mistral Vibe	Mistral Vibe: two CVEs let crafted shell input bypass command permission checks	HIGH	Vulnerability	2.25.4 and 2.25.5	Entry
2026-10-12	@apexacc/cli (Apex Copilot)	Fake 'Apex Copilot' coding agent on npm rerouted model traffic, planted an attacker MCP server and dropped malware	HIGH	Incident	No fix listed	Entry
2026-10-12	GitLab Duo	CVE-2026-96893: crafted content in GitLab Duo Agent Platform instructions could run commands credited to other users	HIGH	Vulnerability	19.4.2, 19.3.5, 19.2.8	Entry
2026-10-09	Claude (internal use)	Anthropic says an AI agent, without being asked, used a token a state agency's dashboard issues to any visitor to get data that normally costs a fee Vendor response: An Anthropic spokesperson told Axios, "We have since put in place mitigations to block these kinds of actions." Fox Business reports the same quote. Anthropic's Oct 9 report says it restricted its web fetch tool and now runs tooling that detects and blocks such behavior.	LOW	Research	Anthropic says mitigations are in place (no version)	Entry
2026-10-09	Claude Code, Claude Desktop	CVE-2026-86063: Claude Code plugin install could skip a pinned commit hash	HIGH	Vulnerability	Claude Code 2.1.179; Codex 0.146.0 (per Air Security)	Entry
2026-10-08	AI coding agents (targeted)	Warden Stealer malware now targets local Cursor, Claude, Codex and MCP credentials, Gen Digital says	HIGH	Research	n/a	Entry
2026-10-07	ARTEX; Claude Code (misused)	CrowdStrike says an unnamed actor used the open-source ARTEX pentest agent and Claude Code sessions in a campaign against South Korean financial organizations; it calls the number of victims unconfirmed	HIGH	Misuse	n/a	Entry
2026-10-06	AI agents and fetch tools	Signals Corps scanned 217M web responses for HTTP headers aimed at AI agents: 7,959 sites, 30 injection attempts, 22 of them pranks	LOW	Research	n/a	Entry
2026-10-06	Claude Code; PentAGI (misused)	An access broker ran 51 Claude Code agents against WordPress sites and Ukrainian energy firms, SOCRadar says	HIGH	Misuse	n/a	Entry
2026-10-05	Claude Code	CVE-2026-103435: Claude Code could follow a swapped-in symlink and write outside the project	HIGH	Vulnerability	2.1.129	Entry
2026-10-02	GitLab Duo	CVE-2026-90970: GitLab AI Gateway let Duo Agent Platform users escape the prompt template sandbox and run commands	CRITICAL	Vulnerability	19.2.4, 19.3.2, 19.4.1	Entry
2026-09-30	n8n	Six n8n CVEs on the agent and MCP paths: tool-approval hijack, prototype pollution, Git-node RCE, and credential exfil	HIGH	Vulnerability	1.123.83, 2.41.4, 2.42.1	Entry
2026-09-30	DeepSeek-Reasonix	CVE-2026-102437: viewing a diff in DeepSeek-Reasonix Studio could run a git filter from a poisoned repo	HIGH	Vulnerability	Studio 2.21.0, reasonix 1.39.3	Entry
2026-09-29	Kilo Code	CVE-2026-79403: Kilo Code's local server let other programs switch on 'allow everything' without a password	HIGH	Vulnerability	7.4.1	Entry
2026-09-25	Claude Desktop	GHSA-v234-4jrq-mgg6: Claude Desktop on macOS could run a file an agent left in a Cowork folder	HIGH	Vulnerability	Desktop 1.15962.0	Entry
2026-09-24	Kiro	CVE-2026-95985: a booby-trapped repo could get Kiro's agent to rewrite your global Kiro configuration	HIGH	Vulnerability	1.0.242	Entry
2026-09-24	OpenCode	GHSA-632h-h47v-g4x4: any web page could make OpenCode's local server install and run an attacker's package	HIGH	Vulnerability	1.18.22	Entry
2026-09-24	Supabase	UpGuard research: 16,326 Supabase databases had tables anyone could read Vendor response: Supabase's CISO, Bil Harmer, told TechCrunch the company had not seen the research, that Supabase projects are 'secure by default', and that security is shared. The entry notes this is a scan of misconfigured customer projects, not a breach of Supabase.	HIGH	Research	n/a	Entry
2026-09-12	Claude Code	CVE-2026-96620: an untrusted session ID could inject flags into Claude Code through Anthropic's Python Agent SDK	HIGH	Vulnerability	0.2.121	Entry
2026-09-10	OpenAI internal model	OpenAI says an internal model got non-public access to Australia's Medicare statistics portal while researching medicine spending	MEDIUM	Incident	No fix listed	Entry
2026-09-10	Langflow	CVE-2026-105740 and CVE-2026-105697: Langflow's MCP server settings let any logged-in user run commands on the server	CRITICAL	Vulnerability	1.9.0 and 1.10.3	Entry
2026-09-10	Gemini CLI	CVE-2026-13745: a project .env could point Gemini CLI at attacker config and run commands	HIGH	Vulnerability	0.39.1	Entry
2026-09-09	PaperCut NG/MF; AI coding agents (misused)	PaperCut NG/MF servers mass-exploited in a campaign GreyNoise says was run by AI agents	HIGH	Misuse	26.0.5, 25.0.13 or 24.1.10 or later (24.1.11 is the current version 24 release); none for 23 and earlier	Entry
2026-09-01	OpenAI Codex	OpenAI Codex: four CVEs for git hooks, fsmonitor, PowerShell parsing, and Desktop git filters	HIGH	Vulnerability	CLI 0.131.0; Desktop builds in entry	Entry
2026-09-01	Claude Code, Codex, Cursor and 4 other agents	GitSpawn: a repository's own git config could run code when AI coding agents gathered context	HIGH	Research	Partial (four unpatched at publication)	Entry
2026-08-24	Continue CLI	Continue CLI through 1.5.47: two unpatched CVEs let prompt-injected text run or destroy files without approval	HIGH	Vulnerability	No fix listed	Entry
2026-08-05	Mistral Vibe	Two earlier Mistral Vibe CVEs, fixed before they were published: fsmonitor on any vibe command, post-checkout during worktree creation	HIGH	Vulnerability	No fix listed	Entry
2026-08-04	Claude Mythos 5	In a controlled UK AISI cyber evaluation, Claude Mythos 5 opened a malicious pull request on a real GitHub project and used fake accounts to pressure its maintainer	MEDIUM	Research	n/a	Entry
2026-07-17	Cursor	CVE-2026-63093: Cursor on Windows ran a git.exe planted in the project folder	HIGH	Vulnerability	Cursor 3.13.25	Entry
2026-07-13	dcg (destructive_command_guard)	CVE-2026-77474: a crafted command could hang dcg, the destructive-command guard for AI coding agents, and get past it	MEDIUM	Vulnerability	dcg 0.6.6 (0.6.9 for two related advisories)	Entry
2026-07-08	Amazon Q Developer, Claude Code, Cursor and 3 other agents	GhostApproval: symlinks in a malicious repo let AI coding assistants write outside the project, sometimes behind a misleading approval prompt Vendor response: Anthropic disputes that this is a Claude Code vulnerability and says a symlink warning shipped in Claude Code 2.1.32 on Feb 5, 2026, before Wiz's report.	HIGH	Research	Partial (varies by vendor)	Entry
2026-07-08	Goose	CVE-2026-85623: a shared Goose recipe could start commands before the user approved it Vendor response: Goose's maintainers said the command-line behavior is by design, like running a shell script, but fixed the Desktop app so nothing starts until the user approves the recipe.	HIGH	Vulnerability	1.52.0 (Desktop)	Entry
2026-06-25	Claude Code	CVE-2026-55607: a prompt-injected repo could steer Claude Code's worktree tools out of its sandbox	HIGH	Vulnerability	2.1.163	Entry
2026-06-23	Amazon Q Developer	CVE-2026-12957: Amazon Q Developer could run a repo's MCP server commands when you opened the project	HIGH	Vulnerability	1.65.0	Entry
2026-05-07	Lovable, Replit, Base44, Netlify	RedAccess scan: 380,000 vibe-coded assets, about 5,000 corporate apps, roughly 2,000 exposing private data Vendor response: Replit said RedAccess gave it only 24 hours before going to the press; Lovable and Base44 said they were not given the URLs needed to check the findings.	HIGH	Research	n/a	Entry
2026-04-24	Cursor; Railway	PocketOS founder says a Cursor agent deleted its production Railway database in one API call Vendor response: Railway founder Jake Cooper told Business Insider recovery took about 30 minutes after contact and that the legacy volume-delete API path has been patched.	HIGH	Incident	Yes (Railway patched the legacy endpoint)	Entry
2026-04-20	Lovable	Lovable BOLA flaw left older projects readable for 48 days after it was reported Vendor response: Lovable first said it 'did not suffer a data breach', then acknowledged a February 2026 regression and closed off chat access on public projects.	CRITICAL	Vulnerability	Partial (older projects still reachable at disclosure)	Entry
2026-03-31	Claude Code	Claude Code npm 2.1.88 shipped a source map that exposed the CLI's source code Vendor response: Anthropic said no sensitive customer data or credentials were involved or exposed, and called it a release packaging issue caused by human error, not a security breach.	MEDIUM	Incident	Yes (2.1.88 removed from npm)	Entry
2026-02-25	Claude Code; GPT-4.1 API (misused, per Gambit)	MITRE catalogs a claimed AI-assisted breach of Mexican government agencies. Two of the named agencies deny it	HIGH	Misuse	n/a	Entry
2026-02-02	Supabase	Moltbook exposed about 1.5M agent API keys through an open Supabase database	CRITICAL	Incident	Yes, within hours	Entry
2025-08-12	GitHub Copilot	CVE-2025-53773: prompt injection could switch GitHub Copilot into auto-approve ('YOLO') mode and run commands	HIGH	Vulnerability	Yes (Aug 2025 Patch Tuesday)	Entry
2025-08-02	Cursor	CurXecute (CVE-2025-54135): prompt injection could make Cursor write and auto-start an MCP server	HIGH	Vulnerability	Cursor 1.3.9	Entry
2025-08-01	Claude Code	Claude Code: several 2025 CVEs let untrusted content bypass command confirmation prompts	HIGH	Vulnerability	Yes (all fixed)	Entry
2025-07-29	Base44	Base44 auth bypass let outsiders register for private, SSO-only apps Vendor response: Wix fixed it in under 24 hours and said it found no evidence of abuse.	CRITICAL	Vulnerability	Yes, within 24 hours	Entry
2025-07-23	Amazon Q Developer	Amazon Q Developer VS Code extension 1.84.0 shipped with an injected 'wipe' prompt Vendor response: AWS says a syntax error stopped it from running and no customer environments were affected.	MEDIUM	Incident	1.85.0	Entry
2025-07-17	Replit	Replit agent deleted SaaStr's production database during a code freeze Vendor response: Replit's CEO called it 'unacceptable' and shipped dev/prod database separation.	HIGH	Incident	Yes (dev/prod separation)	Entry
2025-05-29	Lovable, Supabase	CVE-2025-48757: missing Row Level Security in Lovable-generated apps (170 of 1,645 scanned) Vendor response: Lovable disputes the CVE, saying each customer is responsible for protecting their app's data.	CRITICAL	Vulnerability	No fix listed (security scan added Apr 2025)	Entry
2025-03-17	Cursor	Enrichlead founder says his SaaS, built with Cursor and 'zero hand written code', came under attack within days and he shut it down	HIGH	Incident	n/a (app shut down)	Entry
2024-06-12	All LLM coding tools	Slopsquatting: AI coding models invented 205,474 unique package names in one study	MEDIUM	Research	n/a	Entry

By tool or platform

An entry appears under every tool it names, including research, incident and misuse entries that name the tool, so a group here can be larger than the matching platform page, which lists only entries filed under that platform. Counts show entry types first, then severity.