Three AI Security Disasters in One Week: The Vibe Coding Reckoning

TL;DR: In a single week in April 2026, three separate AI platform security failures exposed a pattern that should terrify anyone building with AI tools. Lovable (a $6.6 billion “vibe coding” platform) left every user’s source code, database credentials, and AI chat histories accessible for 48 days through a basic API flaw. Vercel got breached through Context.ai, a third-party AI evaluation tool that gave attackers a path into its internal systems. And Bitwarden’s CLI was hijacked in a supply chain attack where the malware specifically hunted for credentials to Claude, Cursor, and Codex CLI. Three incidents. Three different attack vectors. One conclusion: AI tools are the new attack surface, and nobody is securing them fast enough.

One Week. Three Attack Vectors. Same Lesson.

Let’s lay out the timeline:

April 19: Vercel confirms attackers breached its systems through Context.ai, a compromised AI evaluation tool. ShinyHunters wants $2 million for the stolen data ^[1]
April 20: Security researcher @weezerOSINT goes public with Lovable’s BOLA vulnerability. Five API calls from a free account could pull any user’s source code, database passwords, and AI conversations ^[2]
April 22: Bitwarden’s CLI npm package gets hijacked for 90 minutes. The malware doesn’t just steal SSH keys; it specifically looks for Claude, Cursor, Aider, and Codex CLI credentials ^[3]

Three platforms. Three completely different failure modes. But the same root cause: AI tools are being adopted faster than anyone can audit, secure, or even understand the new attack surfaces they create.

Lovable: 48 Days, $6.6 Billion, Zero Access Control

We covered the Lovable breach in detail, but it’s worth revisiting as exhibit A in this pattern.

Lovable is the poster child for vibe coding: the AI-driven approach to building apps from natural language prompts that Collins English Dictionary named Word of the Year 2025. The company hit $10 million in annual recurring revenue with just 15 employees. Raised $200 million at a $1.8 billion valuation in July 2025. Then $330 million at $6.6 billion in December 2025 ^[4]. Eight million users.

The security? A Broken Object Level Authorization flaw, literally #1 on the OWASP API Security Top 10. The platform verified you had a valid login but never checked whether you actually owned the project you were requesting. Five API calls. Every project created before November 2025 was fair game ^[2].

A researcher reported it on March 3, 2026. HackerOne marked it as a “duplicate.” Nobody fixed anything. Forty-eight days later, @weezerOSINT went public ^[2] ^[4].

Then came the response. Statement one: “We did not suffer a data breach.” The exposed data was “intentional behaviour.” Statement two: actually, the documentation was “unclear.” Statement three: blame HackerOne. Reports were “closed without escalation because our HackerOne partners thought that seeing public projects’ chats was the intended behaviour” ^[2] ^[4].

CEO Anton Osika eventually posted on LinkedIn: “I take accountability.” He called it a failure of Lovable’s vulnerability disclosure process and said “Lovable should be the safest place to build” ^[5].

This was Lovable’s third major security incident in 13 months. In April 2025, CVE-2025-48757 (CVSS 8.26–9.3) hit 170 of 1,645 scanned Lovable apps. Seventy percent had Row Level Security disabled entirely ^[4].

Vercel: When Your AI Tool Is the Front Door

The Vercel breach is a different animal. This isn’t about bad code; it’s about the expanding web of AI tools that plug into production environments without anyone fully understanding the risk.

Context.ai is an AI evaluation platform. A Vercel employee connected it to their Google Workspace with deployment-level OAuth scopes. The attacker compromised Context.ai first, used that access to pivot into the employee’s Google Workspace, then moved laterally through Vercel’s internal systems via Linear and GitHub integrations ^[1].

One OAuth token. One employee. One AI tool nobody audited. That opened up 580 employee records, environment variables, and (according to the attacker) API keys, source code, and database contents. The asking price on BreachForums: $2 million ^[1].

This is the first major breach directly caused by an AI agent tool. Not an AI vulnerability. Not AI-generated bad code. An AI tool that was plugged into production infrastructure and became the attack path itself.

Bitwarden: The Malware That Went Hunting for AI Credentials

The Bitwarden CLI attack is the most forward-looking of the three. On April 22, Bitwarden’s npm package was compromised for 90 minutes (5:57–7:30 PM ET) through the ongoing Checkmarx supply chain campaign ^[3].

The malware (AES-256-GCM encrypted, exfiltrating to “audit.checkmarx[.]cx”) stole the usual developer targets: SSH keys, cloud credentials, browser cookies. But it also specifically probed for something new ^[3]:

Claude Code credentials (~/.claude/)
Cursor authentication tokens
Aider configuration files
OpenAI Codex CLI credentials

The malware called them by name. Threat actors have figured out that AI coding assistants now hold the keys to entire development environments. Steal a developer’s Claude Code session, and you can potentially access every repository, environment variable, and deployment pipeline that developer touches ^[3].

A year ago, nobody was writing malware that targets AI coding tools. Now it’s a named category of credential theft.

The Numbers Are Brutal

The broader vibe coding security picture is grim. The research piling up in Q1 2026 paints a consistent picture ^[4] ^[6]:

40–62% of AI-generated code contains security vulnerabilities
91.5% of vibe-coded applications had at least one AI hallucination-related vulnerability in Q1 2026 (sample of 200+ apps)
2.74x higher flaw rate in AI-written code versus human-written code across 470 GitHub pull requests
60%+ of vibe-coded apps exposed API keys or database credentials in public repositories
35 CVEs disclosed in March 2026 from AI-generated code, up from 6 in January
AI-assisted commits expose secrets at twice the rate of human-written code: 3.2% vs. 1.5%

And it gets worse with iteration. An IEEE-ISTAS controlled experiment measured a 37.6% increase in critical vulnerabilities after just five rounds of AI-assisted code refinement ^[6]. The more you vibe code, the more holes you create.

Meanwhile, adoption is accelerating. Enterprise vibe coding grew 340% year-over-year. Non-technical user adoption surged 520%. Eighty-seven percent of Fortune 500 companies have adopted at least one vibe coding platform ^[4]. More people are building more apps with less understanding of what they’re building.

Moltbook: The Preview of What’s Coming

In February 2026, a social networking site called Moltbook launched. The founder publicly stated he “didn’t write one line of code”; the entire thing was vibe-coded. Three days after launch, security firm Wiz found a misconfigured database exposing 1.5 million authentication tokens and 35,000 email addresses ^[6].

Moltbook is a preview. The vibe coding platforms keep telling users they can build “production-ready” apps. But “production-ready” without security review means “ready to be breached.”

AI Tools Are the New Attack Surface

These three incidents map to three distinct attack vectors that barely existed a year ago:

AI platforms with bad security (Lovable). The tools themselves have fundamental access control failures. When 70% of apps on your platform have Row Level Security disabled, you don’t have a bug. You have a design philosophy problem.
AI tools as supply chain entry points (Vercel/Context.ai). AI evaluation tools, agent frameworks, and development plugins are being granted production-level access to infrastructure. Compromise one, and you’re inside the entire development environment.
AI credentials as high-value targets (Bitwarden/Checkmarx). AI coding assistants now hold session tokens with broad access to repositories, secrets, and deployment pipelines. Malware authors have already adapted.

This isn’t three isolated incidents. It’s three faces of the same structural problem: the AI development ecosystem grew faster than its security model. And the people most enthusiastic about adopting these tools are often the least equipped to evaluate their risk.

What You Should Do

If you build with AI coding platforms:

Never trust the platform’s default security settings. Check Row Level Security on every database table. Verify API endpoint authorization yourself
Treat AI-generated code exactly like untrusted third-party code. Review it. Audit it. Pentest it before production
Don’t paste secrets into AI chat interfaces. Those conversations get stored. If the platform gets breached, your credentials go with it

If you use AI development tools (Claude Code, Cursor, Copilot, etc.):

Audit what OAuth scopes and access levels your AI tools have. Revoke anything beyond what they strictly need
Enable MFA everywhere. A stolen session token is less useful when it can’t re-authenticate
Rotate credentials for AI tools regularly; treat them like any other privileged access point
Check ~/.claude/, ~/.cursor/, and similar credential directories for unexpected access

If you manage development teams:

Inventory every AI tool your developers are using. You can’t secure what you don’t know about
Apply the same third-party vendor risk assessment to AI tools that you’d apply to any SaaS product with production access
Block AI tools from connecting to production environments until they’ve been security reviewed

The Reckoning

Andrej Karpathy coined “vibe coding” in February 2025. Collins English Dictionary made it Word of the Year. By April 2026, we have three major security incidents in a single week, an exponential rise in AI-generated CVEs, and malware that specifically targets AI coding tool credentials.

That’s a 14-month journey from marketing buzzword to systemic security crisis.

The EU AI Act’s high-risk obligations take effect August 2, 2026. The question is how many breaches happen between now and then. At this rate, April 2026 won’t be the worst month for AI security. It’ll be the month we started paying attention.

References

Published: April 26, 2026