Vibe Coding · 2026

Vibe coding safety in 2026: the incidents, the numbers, and an honest answer

VibeSafe · August 13, 2026 · 9 min read

We wrote about whether vibe coding is safe a few months ago. Since then, the question stopped being hypothetical: an "agent-first" social network leaked 1.5 million tokens, and one of the biggest vibe-coding platforms spent eleven weeks with its own users' data readable by any account. Here's what actually happened this year, what's new (MCP server risk is now a real category), and an updated answer.

The incidents that made this year different

Abstract vulnerability rates are easy to shrug off. These aren't abstract — they're what happens when the statistics above land on a real app with real users.

1Moltbook — a public key with no lock behind it January 2026

An entrepreneur launched an "agent-first" social network — built entirely by prompting AI, by his own account without writing a line of code — where only AI agents could post and comment. Within days, researchers found the Supabase API key sitting in plain sight in the client-side JavaScript, with no Row-Level Security policy on the database behind it. Anyone could query the production tables directly. The result: roughly 1.5 million API authentication tokens exposed, along with 35,000 email addresses and thousands of private messages. Because those tokens worked like passwords for the platform's AI agents, exposing them meant anyone could impersonate any agent on the network.

2Lovable's public projects were readable by any account Feb–Apr 2026

This one matters more than most, because the affected system wasn't a side project — it was Lovable, one of the platforms people use to vibe-code, valued at $6.6 billion. From February 3 to April 20, 2026 — close to eleven weeks, after a researcher's report in February — a flaw meant anyone with a free Lovable account could read the source code, database credentials, and AI chat history of other users' publicly-visible projects. Private projects and Lovable Cloud were never affected. Because vibe-coded apps routinely embed third-party keys — Supabase, Stripe, Google — directly in that source, the exposure reached into whatever those public projects held. Lovable's own public position is that this wasn't a data breach, describing it as a visibility issue with public projects rather than unauthorized access; independent researchers who reported it characterized it more seriously. Either way, the fact both sides agree on: that data was readable by any account for weeks, and Lovable shipped a fix within two hours of the public report.

3Scanning 380,000 live vibe-coded assets May 2026

Security firm RedAccess scanned roughly 380,000 publicly accessible assets — apps, databases, and related infrastructure — built with vibe-coding tools including Lovable, Replit, and Base44. Close to 5,000 of them were found exposing sensitive corporate data outright: medical records, financial information, internal corporate strategy documents, customer chat logs. Wired and Axios independently verified specific examples, including exposed clinical-trial status data and a bank's internal financials. It's a small share of everything scanned — but 5,000 real, live exposures, reachable with no special access, is not a hypothetical.

4The DM leak nobody's demo would have caught 2026

A popular app leaked users' private direct messages through a broken access-control check — logic an AI generated and nobody reviewed. No credentials were needed, just a request most humans wouldn't think to make, but any automated scanner (or curious user) would try within minutes.

The new frontier: MCP servers and agent tooling

This risk category isn't entirely new — it just scaled up. In July 2025, SaaStr's Jason Lemkin documented an AI coding agent from Replit deleting the database of business contacts it was building a front-end for, mid-project and during an explicit code freeze, affecting records tied to over 1,200 executives and 1,190+ companies before Replit recovered the data and shipped new safeguards. That incident put "what is this agent allowed to do without asking me first" on the map. 2026 has scaled the same question up: as more people connect AI coding assistants to MCP (Model Context Protocol) servers — tools that let an agent read files, call APIs, or run commands on your behalf — that connection itself has become a target. In April 2026, security firm OX Security disclosed a command-injection flaw across MCP's official SDKs, independently confirmed by VentureBeat and Tom's Hardware and assigned CVE-2026-30623, estimated to affect on the order of 200,000 server instances across a supply chain of more than 150 million downloads.

Slopsquatting is no longer theoretical

We've written before about hallucinated packages — AI tools inventing plausible-sounding library names that don't exist. This year it stopped being a hypothetical risk: research across 2.23 million AI-generated code samples found that roughly 1 in 5 contained at least one hallucinated package name, and attackers are now pre-registering those exact names with malicious code waiting behind them. One fabricated package was copied into a major company's public documentation and picked up over 30,000 downloads in three months; another propagated through 237 repositories via AI agents installing their own generated output, with no human in the loop at all.

So — is vibe coding safe? An honest answer, updated

The answer hasn't changed in shape, but it's better evidenced now: vibe coding is safe to ship after you check the code, and genuinely risky if you don't. What's different this year is that we now have a running list of real 2026 incidents showing exactly which check would have caught each one — a missing RLS policy, an authorization check nobody tested, a permission an agent shouldn't have had by default, an import nobody verified. Every single failure above was detectable with the right review step. None of them required a sophisticated attacker; independent researchers and automated scans found most of them, which means the same kind of scanning can find yours first too.

The updated pre-launch routine

• Scan the code for exposed secrets and move them to environment variables
• Enable Row-Level Security (or equivalent) on every database table — and test it, not just enable it
• Test the app logged out, and as a different user — confirm private data actually requires the right session
• Verify every imported package actually exists and isn't known-vulnerable before it ships
• If you've connected an MCP server or agent tool, check what it's allowed to do without confirmation — especially anything destructive
• Re-scan after every deploy, not just the first one — the platform you build on is part of your risk surface too

A scanner like VibeSafe automates the code checks in about ten seconds and explains each fix in plain English — so the answer to "is vibe coding safe?" becomes "yes, because I checked," the same way it was before this year's incidents, just with a longer list of things worth checking.

Related reading: