Vibe Coding Is Causing ‘Thousands’ of Data Security ...

What Happened

A new report is putting hard numbers behind a fear that's been simmering since AI coding tools went mainstream: apps built through "vibe coding" — the practice of describing an app in plain English and letting an AI model like OpenAI's Codex or Lovable generate the code — are shipping with serious, sometimes trivial-to-exploit security holes. Security researchers at RedAccess reportedly identified thousands of exposed data issues tied to AI-generated applications, and a demonstration by a reporter showed just how low the bar has fallen: a functioning global mass-surveillance-style site was allegedly built in about two hours using Codex, with no traditional coding expertise required.

Lovable, one of the popular vibe-coding platforms named in the research, pushed back through a spokesperson, saying RedAccess's findings lacked the URLs or technical specifics needed to verify or act on the claims — while still confirming the company is looking into the matter internally.

Why It Matters

Vibe coding has been marketed as a democratizing force: non-engineers can spin up working software — dashboards, internal tools, customer-facing apps — in minutes. But that speed comes at a cost. Traditional software development includes checkpoints like code review, security audits, and QA testing that catch issues such as exposed API keys, unprotected databases, and missing authentication layers. When an AI model generates an entire application from a prompt, those checkpoints are often skipped entirely, especially by hobbyists or small teams without security expertise.

The result, according to this reporting, is a growing surface area of amateur-built apps that inadvertently expose user data, sit unmonitored, or replicate sensitive functionality (like surveillance tools) without the safeguards that would normally accompany such capability. That's a meaningful shift: security debt is no longer confined to enterprise codebases maintained by professional teams — it's spreading to a much wider, less accountable population of app creators.

The Bigger Picture

The dispute between RedAccess and Lovable also highlights a structural problem in this space: without shared vulnerability-disclosure standards, it's hard for platforms to verify third-party security claims, and hard for outside researchers to prove systemic risk without publishing exploitable details. That tension — transparency versus responsible disclosure — will likely intensify as more vibe-coding platforms scale.

As tools like Codex, Lovable, Cursor, and similar AI builders lower the barrier to shipping software, the incentive structure rewards speed over safety. Unless platforms build in default security guardrails — sandboxing, automatic secret scanning, mandatory access controls — the gap between how easy it is to build an app and how easy it is to secure one will keep widening, with real user data caught in the middle.