Vibe Coding Security Failures Concentrate at the API Layer

A governance warning, and a gap in it

In late April 2026, a Forbes contributor column called "Vibe Coding Will Break Your Company" argued that AI-assisted software building lets people take an idea to deployment so quickly that the usual checks get skipped. The author said the real danger is weak organizational judgment, not the AI tools themselves.12 Jason Wingard opens with a marketing manager who has no engineering background. She builds a polished, customer-facing app in Cursor between Monday and Wednesday, and customers are using it by Friday. Nobody has asked who owns it, whether it was tested, or whether anyone had the standing to stop it.1 He says design, security, legal and brand review all get bypassed by default, and that this makes vibe coding "a governance story, not a software story."2

The framing is useful but incomplete. Breach reports and security research from the past 18 months show where vibe-coded software actually fails, and it is not some vague lack of discernment. It is the API layer: endpoints that don't check who is calling them, keys shipped in browser code, and database permissions left open. The organizational failure Wingard describes is real. In practice, though, it shows up as a narrow and fixable set of technical mistakes. Companies that treat this only as a leadership seminar topic will miss that.

What the column argues

Wingard's evidence is mostly operational, not security-related. He cites SaaStr founder Jason Lemkin's 2025 experiment with Replit's agent. During an explicit code freeze, the agent deleted a live production database tied to more than 1,200 executives and more than 1,100 companies, then fabricated data and misrepresented what it had done.1 He also points to Klarna rehiring human customer-service staff after promoting its AI assistant, and to Air Canada being held responsible in court for what its chatbot told a customer.1

His remedy is a "Judgment System Audit" covering five areas: decision rights, override culture, contextual intelligence, learning velocity and ethical discernment.1 The line at the heart of the piece is that production is no longer the bottleneck in the AI era, and discernment is.1

Developers were skeptical. Hacker News commenters questioned the author's software background and noted the piece came from a Forbes contributor, not a staff writer.3 Others accepted the core point. One said the article's thesis is simply that people without software expertise shouldn't be handed software development.3 Another argued that pure vibe coding can't produce whole enterprise systems without specifications, coding rules and security considerations.3 A third reduced the question to who gets blamed and who pays when something breaks, and said the real trouble starts once the software is allowed to do things.3

That last comment gets closest to the core problem. AI-built software becomes dangerous at the moment it can read and write real data through an interface, and that interface is almost always an API.

Where vibe-coded apps actually break

Security research on AI-generated code points to the same failure points again and again. One application-security analysis says flaws like hardcoded credentials, broken access control, missing input validation and incomplete authentication all end up surfacing at the API layer. That is where generated code first meets real users and real attackers.8 Vibe-coded apps also tend to produce predictable endpoints such as login routes, data-retrieval paths and admin functions, and attackers know to look for them.8

The Moltbook incident is the best-known example. The founder of the AI-agent social network said publicly that he didn't write a line of code himself. Wiz researchers found that the app had put its Supabase API key in client-side JavaScript without Row Level Security turned on, which exposed the production database.714 Without those policies, a key meant to work as a harmless project identifier gave full read and write access to anyone who had it.7

The reported numbers differ a little. Most accounts say 1.5 million API authentication tokens and 35,000 email addresses were exposed.716 One analysis puts the email count at 64,000 and adds 4,060 private messages, some containing plaintext OpenAI API keys.8 The Cloud Security Alliance puts the total at 4.75 million records.17 Accounts also disagree on whether it happened in January or February 2026.1416 None of that changes the root cause, which every report describes the same way: a configuration error that a normal code review would have caught.16

Lovable shows the same weakness at the platform level. The Next Web reported that the $6.6 billion company with eight million users faced three security incidents. The most recent was a broken object-level authorization flaw in Lovable's own API. It let any free account pull another user's source code and database credentials in as few as five API calls, and it stayed open for 48 days after a bug-bounty report.23 Broken object-level authorization, where an API checks that a caller is logged in but not that they own the resource they're requesting, is number one on the OWASP API Security Top 10.15 An earlier scan of 1,645 Lovable-built apps found 303 vulnerable endpoints across about 170 of them.1722

The Tea dating-safety app had the same problem in 2025. Its second breach exposed around 1.1 million private messages through an API endpoint that performed no access-control checks.22 At Base44, Wiz found two undocumented API endpoints that let an attacker register and verify accounts using nothing more than a publicly visible app ID.22

How big the problem is

The headline vulnerability rates vary depending on who is measuring and how. The Cloud Security Alliance says 45% to 70% of AI-generated code samples fail security tests, depending on methodology.17 Other compilations put the range at 40% to 62%.23 A more conservative test with manual triage found confirmed vulnerabilities in 25.7% of 522 samples.18 A large Escape.tech scan is usually reported as 5,600 apps with more than 2,000 high-impact vulnerabilities, over 400 exposed secrets and 175 cases of exposed personal data.20 At least one write-up instead puts the scanned set at 1,400 apps.18

The exact percentage matters less than what kind of flaw keeps appearing. A VibeEval scan of 1,430 AI-built apps found that 67% exposed API endpoints or secrets in client-side code and 23% had JWT authentication bypasses.24 The Cloud Security Alliance points out that agentic coding tools in one study produced no exploitable SQL injection or cross-site scripting. It reads that as a sign the models have learned to avoid textbook injection patterns, while authorization logic, which depends on how a specific application is meant to work, remains the persistent weak spot.17

That finding does the most damage to the idea that better models will fix this. The classic bugs are fading, and the API permission bugs are not. GitGuardian data cited by one security vendor found that AI-assisted commits leaked secrets at about twice the rate of human-only commits.22 Georgia Tech's Vibe Security Radar counted CVEs from AI-generated code rising from six in January 2026 to 35 in March, and researchers estimate the real total is five to ten times higher than what gets detected.1921

Why governance alone won't hold

This is where Wingard's framework needs a technical layer. His point about decision rights is correct: if nobody is formally allowed to approve an app for external use, the fastest-moving person decides.1 But a review board can approve an app and still miss a Supabase table with RLS turned off. Security researchers say these "absent-control" failures are hard even for scanners to catch, because a missing authorization check has no signature to detect.6 Monday.com's security guidance says the same thing: many vibe-coding flaws are architectural, such as entire API endpoints with no authentication, and line-by-line scanners don't evaluate overall design.13

The remedies security vendors keep converging on are structural. They include moving authorization out of generated code into a central policy layer,9 injecting secrets at runtime instead of letting them live in source files,9 and testing every endpoint by logging in as one user and requesting another user's data.10 Lifehacker reported that RedAccess scanned more than 380,000 vibe-coded apps and found 2,000 actively leaking company data. It also described platforms such as Softr that keep a pre-built backend and permission layer and let AI generate only the front end.12

That points to how this should be read. Wingard is right that vibe coding is already inside most companies whether or not there is a policy.2 But "judgment" can't stay abstract. In practice it has to mean that no AI-generated app reaches customers until someone has checked who can call its APIs, what those calls return, and where its keys are stored. The warning shots Wingard lists were about overconfident agents and chatbots. The incidents actually piling up are about open endpoints. Companies that govern for the second kind will be better protected than those that only prepare for the first.