In January 2026, an AI social network called Moltbook launched to a wave of attention. Within three days, security researchers found its production database wide open: 1.5 million API authentication tokens, 35,000 email addresses, and private messages between users, all reachable by anyone who looked. The root cause wasn't exotic — the AI-generated code shipped a Supabase API key directly in client-side JavaScript, and nobody had turned on Row Level Security (RLS) to restrict what that key could read.
That's not a freak accident. It's the single most common failure mode in AI-generated applications, and it happens for a specific, understandable reason.
Tap to enlarge
01Why AI tools do this
Models optimizing for "working code" and models optimizing for "secure code" aren't the same objective. When you ask an AI builder for a feature, the fastest path to something that visibly works is often the least secure one: hardcode the key, skip the access-control check, connect straight to the database from the browser. It runs. It looks done. Nothing in the demo tells you it's wide open.
This is also why the problem scales with usage rather than fading as the tools improve. A large-scale scan of 5,600 publicly deployed vibe-coded applications found roughly 2,000 highly critical vulnerabilities, 400 exposed secrets (API keys, access tokens), and 175 instances of exposed PII — including medical records and payment data — sitting in plainly reachable endpoints. Georgia Tech's Vibe Security Radar tracked 35 new CVE entries directly caused by AI-generated code in March 2026 alone, up from six in January — a pace that's still climbing as more non-security-background builders ship faster than ever.
02The #1 root cause: broken access control
Broken access control is the number one risk on the OWASP Top 10, and it's the specific cause behind most public vibe-coding breaches — not a novel exploit, just a database or an endpoint that anyone could read because nothing was checking who was asking. In the Moltbook case specifically, this meant no Row Level Security policy stood between a public API key and the entire dataset.
If you're not from a security background, "Row Level Security" and "access control" can sound like enterprise jargon. In practice it's one question: if someone found this URL or this key, what could they see? Most AI-generated apps never get asked that question before they ship, because nothing in the chat interface prompts it.
03What actually catches this before it ships
The fixes that matter are boring and specific, not a general "be more careful":
- Scan for hardcoded secrets on every generation, not just once at the end — a key that gets removed in v3 but was committed in v1's public repo history is still leaked.
- Check for
eval()and dynamic code execution — a common vector for a second-stage exploit once an attacker has any foothold. - Verify requests only go to the third parties you actually intended — silent data exfiltration to an unexpected endpoint is invisible in a normal demo.
- Actually load the app and check what a real visitor could reach — a static code read misses runtime issues; you need something that opens the app the way a user would.
VibeSafe Builder is built around that list. Every generation is scanned server-side for hardcoded keys, eval() and unexpected outbound requests before you can publish. Separately, Launch Check opens the app in a real headless browser, because a pattern-matching scan misses things that only show up when the page runs. Neither is a professional security review, and you should get one if you are handling real user data at scale. What they do catch is the Moltbook mistake — in a minute, rather than after three days in public.
04The takeaway
If you're building with any AI tool — not just this one — the question to ask before every "Publish" click isn't "does this work?" It's "if someone found the URL, the key, or the database directly, what would they see?" Most vibe-coding breaches in 2026 have the same one-sentence postmortem: nothing was checking.
05Sources
Arnica — Vibe Coding Security Risks You Can't Ignore 2026
Northflank — How to Vibe Code Securely in 2026
Modall — Vibe Coding Security Risks: What Founders Need to Know
06Related reading
The AI app pre-launch checklist
How VibeSafe Builder scans every build
How to build your first app with AI