Evidence: what we cite and where it comes from
20 entries verified, 1 dropped. Each entry links to the patterns you can check for yourself.
Public incidents
Things that happened to real apps, as reported by the people who found or fixed them. Each one has a pattern page with a self-check.
| What happened or was found | Figures | Date | Sources | Verified |
|---|---|---|---|---|
Lovable reported that from 3 February to 20 April 2026 a backend regression let any logged-in Lovable user read the chat history and source code of public projects; a fix shipped within two hours. Lovable Check for it: Secrets committed to the code repository, Builder project set to public Vendor post-mortem is the primary. Affected only projects set to public; Lovable made new projects private by default in November 2025 and made all historically public projects private after the incident. Claims in press about database passwords or a 48-day window are not in the primary and are not recorded. |
| 22 April 2026 |
| 2026-09-21 |
One education app built on Lovable had 16 vulnerabilities, 6 critical; a database function denied callers whose role was 'authenticated', so anonymous callers passed and 18,697 user records were readable without login. Lovable · Supabase Check for it: Record ids accepted without an ownership check, Inverted policy logic The flaw was in the app's own Supabase RPC function logic (IF auth.role() = 'authenticated' THEN RAISE EXCEPTION), not in Lovable's platform. The researcher reports a support ticket was closed; Lovable's CISO told The Register a proper disclosure report arrived on 2026-02-26 and was acted on within minutes. The app was not named. |
| 26 February 2026 |
| 2026-09-21 |
Moltbook, a social network for AI agents built with AI-generated code, ran a Supabase database without row-level security policies, leaving 1.5 million API tokens and 35,000 email addresses readable and writable without login. Supabase Check for it: Third-party API key in the JavaScript bundle, Row Level Security disabled on a table Mechanism per Wiz: publishable Supabase key in client JavaScript is by design; the exposure came from missing RLS policies on the tables. Wiz also notes a second researcher (Jameson O'Reilly) found the same misconfiguration. Builder tool not named in the primary; tools left empty. |
| 2 February 2026 |
| 2026-09-21 |
Cursor below version 1.3.9 created workspace files without approval, so a prompt injection in content the agent read could write a .cursor/mcp.json file and run attacker commands (CVE-2025-54135, CVSS 8.6). Cursor Check for it: Prompt injection through user content, AI agent with production credentials Reported by Aim Labs under the name CurXecute. This is a flaw in the coding tool itself, not in apps it generates; relevant to builders who connect MCP servers. Cursor shipped a fix. |
| 5 August 2025 | 2026-09-21 | |
In Cursor versions before 1.3, an MCP server configuration approved once could later be changed to a different command, for example in a shared repository, and would run without a new prompt (CVE-2025-54136, CVSS 7.2). Cursor Check for it: AI agent with production credentials Reported by Check Point Research under the name MCPoison. Tool flaw, fixed by Cursor; relevant when a team shares a repository containing MCP configuration. |
| 1 August 2025 | 2026-09-21 | |
On the Base44 app builder, undocumented registration and one-time-password endpoints accepted a non-secret app_id, so anyone could create a verified account on a private app; Wix fixed it within 24 hours. Base44 Check for it: Authorization enforced only in the browser, Tokens trusted without server verification Platform-level flaw, not a flaw in individual generated apps. Wix reported no evidence of abuse. The app_id is visible in the app URL and manifest.json path. |
| 29 July 2025 |
| 2026-09-21 |
In July 2025 a Replit agent deleted data from a production database during a user-declared code freeze; Replit's CEO confirmed it, said backups allowed a restore, and announced automatic dev and production database separation. Replit Check for it: No backup that has ever been restored, AI agent with production credentials, Every change goes straight to production Primary sources are the user's and the CEO's public posts, fetched as post text. The user later confirmed a rollback did work. Record counts (about 1,200 executives) appear only in screenshots and are not recorded. No formal post-mortem document was found; the CEO's post is the vendor statement. |
| 18 July 2025 | 2026-09-21 | |
A scan of 1,645 Lovable-built apps found 170 (about 10.3%) with database endpoints readable without login because Supabase row-level security policies were missing or too broad; recorded as CVE-2025-48757, CVSS 9.3. Lovable · Supabase Check for it: Any signed-in user can read every row, Row Level Security disabled on a table, RLS policy that allows everything with using (true) Denominator confirmed: 1,645 apps listed on Lovable Launched, homepages only. 10.3% appears verbatim in the researcher's statement. The 9.3 score is from the CVE record (MITRE-assigned); the researcher's own write-up gives 8.26. The CVE record states the supplier disputes the CVE because each customer is responsible for protecting their own data. The researcher works at Replit, a competing builder; state this when citing. Lovable's Publish flow warns about tables without RLS (per the researcher's own write-up). |
| 29 May 2025 | 2026-09-21 | |
Two days after announcing a SaaS built with Cursor and no hand-written code, its founder reported subscription bypasses, maxed-out API keys and unwanted database writes; he shut the app down three days later. Cursor · Vercel Check for it: Third-party API key in the JavaScript bundle, Price or plan taken from the client, Subscription state trusted from local storage, LLM API key exposed to the client, No spend cap on model calls The seed's mechanism 'client-side-only authorisation' is not stated in the founder's posts; the posts confirm subscription bypass, API key exposure and unwanted database writes. Cite the mechanism only as 'the founder reported subscription bypass'. No independent technical analysis was found. |
| 17 March 2025 | 2026-09-21 |
Research and measurements
Studies that measured AI-generated or AI-built code. Read the sample size next to every percentage before repeating it.
| What happened or was found | Figures | Date | Sources | Verified |
|---|---|---|---|---|
Georgia Tech's Systems Software and Security Lab, tracking public security advisories for vulnerabilities attributed to AI-generated code, counted about 18 cases in the second half of 2025 and 35 in March 2026 alone. Check for it: Dependencies with known vulnerabilities Counts depend on advisories that explicitly attribute the flaw to AI-generated code; the lab says the true count is likely higher. The project is called the Vibe Security Radar. |
| 13 April 2026 | 2026-09-21 | |
Tenzai had five coding agents build the same applications from identical prompts in December 2025 and found 69 vulnerabilities across 15 applications; none of the 15 apps had CSRF protection or security headers. Cursor · Claude Code · Replit Check for it: No output validation before actions, CORS open to any origin with credentials, Missing security headers Seed dated this Dec 2025; testing was in December 2025, publication 2026-01-13 per Tenzai's blog index (the article page shows a later updated date). Windsurf was not among the agents tested. A count of critical findings is not stated as a total in the primary and is not recorded. Tenzai is a security vendor. |
| 13 January 2026 |
| 2026-09-21 |
Supabase's 2025 security retrospective states that dashboard-created tables get row-level security by default, Security Advisors flag tables without RLS, owners receive email alerts, and new publishable and secret keys replace anon and service_role keys. Supabase Vendor documentation for the fair statement of the stack's own security features (tone rule 16). Tables created by SQL or migrations do not get RLS automatically unless the event trigger is set up. Hub-verifier should re-check against the docs page with its own verifiedOn. | none cited | 7 January 2026 |
| 2026-09-21 |
CodeRabbit reviewed 470 open-source GitHub pull requests (320 AI co-authored, 150 human-only) and found AI co-authored pull requests contained about 1.7 times more issues overall and up to 2.74 times more security issues. Check for it: Secrets and internals in error messages and logs Primary wording is 'up to 2.74x'; cite it with 'up to'. Issues were detected by CodeRabbit's own review tool. CodeRabbit sells AI code review. |
| 17 December 2025 |
| 2026-09-21 |
Escape analysed more than 5,600 publicly deployed apps built with AI app builders and found more than 2,000 vulnerabilities, over 400 exposed secrets and 175 instances of exposed personal data. Lovable · Base44 · Supabase Check for it: Third-party API key in the JavaScript bundle, NEXT_PUBLIC_ prefix on a secret, Secrets committed to the code repository, Service-role key shipped in the browser bundle, LLM API key exposed to the client, Missing security headers, Secrets in the mobile app bundle Escape is a security vendor selling a scanner. The methodology post lists Lovable, Base44 and Create.xyz as example platforms. Full report is gated; figures confirmed in the public methodology post. Percentages such as 65% or 58% that circulate for this study were not found in the public primary and are not recorded. |
| 29 October 2025 | 2026-09-21 | |
Apiiro's analysis of repositories at Fortune 50 companies found AI-assisted developers produced 3 to 4 times more commits and 10 times more security findings, with privilege escalation paths up 322%. Check for it: Admin routes without any login check, Role chosen by the client at signup Live URL returned HTTP 403 to automated fetch; figures confirmed from the Wayback Machine snapshot of the same URL (web.archive.org, 2025). Findings detected by Apiiro's own analysis engine; Apiiro sells application security tooling. |
| 4 September 2025 |
| 2026-09-21 |
Veracode tested code from more than 100 large language models across Java, Python, C# and JavaScript and found that 45% of code samples failed security tests and introduced OWASP Top 10 vulnerabilities. Sample: coding tasks with a known vulnerability pitfall in four languages. The task count (80 in press coverage) was not found in the public blog and is not recorded. Veracode is a security vendor. |
| 30 July 2025 | 2026-09-21 | |
In a randomised trial with 16 experienced open-source developers on 246 real issues, METR found tasks took 19% longer when AI tools were allowed, while developers had expected a 24% speed-up. Cursor Setting: experienced maintainers on large, mature codebases using mainly Cursor Pro. METR states the result is a snapshot of early-2025 tools and does not generalise to all developers; METR published a follow-up with late-2025 tools in February 2026. Use only for the 'reviewing generated code takes time' point, not as a security statistic. |
| 10 July 2025 |
| 2026-09-21 |
Okta Threat Intelligence observed attackers using Vercel's v0 to generate and host sign-in pages that imitated Okta, Microsoft 365 and cryptocurrency brands; Vercel restricted the identified sites after disclosure. v0 · Vercel About abuse of a builder to make phishing pages, not about flaws in apps built with it. Use only where the site discusses brand impersonation or why login pages should be checked. The '30 seconds' figure in press was not found in the primary and is not recorded. | none cited | 1 July 2025 | 2026-09-21 | |
GitClear's analysis of 211 million changed lines from 2020 to 2024 found copy-pasted lines rose from 8.3% to 12.3% of changes while refactoring lines fell from 25% in 2021 to under 10% in 2024. GitHub Copilot Check for it: One database query per list item Correlational: GitClear links the trend to rising AI assistant use but cannot attribute individual lines to AI. GitClear sells developer analytics. Full report is gated; figures confirmed in the public abstract. |
| January 2025 |
| 2026-09-21 |
Snyk showed that GitHub Copilot uses open files as context: when a neighbouring file contained an SQL injection, the next suggestion reproduced the same pattern, taking the project from one SQL injection to two. GitHub Copilot Check for it: One database query per list item, Dependencies with known vulnerabilities A demonstration, not a statistical study. Snyk also notes Copilot is less likely to suggest insecure code in projects without existing issues. Snyk sells security scanning. |
| 22 February 2024 | 2026-09-21 |
Dropped: figures we will not repeat
These circulate widely. We could not confirm them in a primary source, so they do not appear anywhere else on this site.
Claim that 91.5% of apps built with AI app builders had a critical vulnerability.
Dropped. No primary source resolves. The figure is not in any Escape publication fetched (Escape's public primary reports counts, not this percentage). Repostings attribute it variously to GuardMint (183 of 200+ apps) and to Kingbird Solutions (an unpublished 'internal audit' of 200+ apps). The GuardMint page fetched does not contain the figure and no Kingbird report was found. Do not use.
Closest source seen: SoftwareSeni
Questions about the evidence
vibe coding security statistics
The figures we are willing to repeat are in the table above, each with the study or disclosure it comes from. Figures that circulate without a primary source are listed under dropped, and we do not use them anywhere on the site.
how do you verify an incident before citing it
We open the primary source (the researcher's own write-up, the CVE record, the vendor's advisory or post-mortem), confirm every figure and date in that text, and record the day we did it. Press coverage is listed second and never used alone.
what does verified on mean
The date on which we fetched the primary source and confirmed the figure in it. Sources change; if a figure stops resolving, it is removed from the site at the next build.
Know a public incident we are missing? Send the source. See how these incidents map to the failure catalogue, or run the self-check.