Loading story…
RedHunt Labs' Project Resonance found that 1 in 5 websites built on 'vibe coding' platforms leak sensitive secrets, including API keys for AI services and backend databases. The research identified over 25,000 unique secrets, with Google Gemini, OpenAI, and ElevenLabs keys most frequently exposed. These leaks pose significant risks, including unauthorized access, financial loss, and data breaches.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
SC Media published a perspective article examining the security implications of AI-assisted coding in enterprises, highlighting concerns around secure code practices and organizational risk.
RedHunt Labs published research in its 'Project Resonance' Wave 15 describing widespread exposure of secrets through 'vibe coded' sites, indicating a large-scale security issue tied to AI-assisted web development.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers examined 9,041 open-source applications built with Claude Code and Lovable, plus 200 publicly deployed applications, and identified 1,186 vulnerabilities. Their audit found that **91%** of deployed applications had at least one flaw and that **65.77%** of identified issues were Critical or High severity, led by broken access control, injection vulnerabilities, and authentication failures. The study attributes recurring defects to eight failure modes involving AI-agent memory, objectives, and knowledge; stronger prompts and agent harnesses reduced, but did not eliminate, exposure. The findings align with reported failures in AI-generated applications, including `CVE-2025-48757` (CVSS 9.3), where Lovable applications using Supabase could expose database tables without authentication when Row Level Security policies were absent. Organizations adopting AI coding agents should enforce human security review, automated application testing, secret scanning, least-privilege authorization, and explicit database access controls before deployment; they should also treat coding assistants and their dependencies as potential supply-chain and prompt-injection targets.
Sep 11, 2026
Researchers from Stanford University, the University of California, Davis, and TU Delft found **1,748 valid API credentials** exposed across roughly **10,000 public webpages** after analyzing about **10 million websites**, revealing a broad secret-leakage problem outside traditional code repositories. The credentials, identified with TruffleHog and detailed in the study *Keys on Doormats: Exposed API Credentials on the Web*, provided access to services including **AWS**, **GitHub**, **Stripe**, and **OpenAI**. The exposed secrets were tied to multinational corporations, critical infrastructure operators, government agencies, and at least one global bank. Most of the exposed credentials were embedded in **JavaScript** resources, often inside bundled files generated by tools such as Webpack, creating direct paths into cloud infrastructure, payment systems, and software repositories. Researchers said AWS keys made up more than **16%** of verified exposures, and cited cases including cloud credentials linked to a global bank’s core infrastructure and firmware repository credentials associated with drones and remote-controlled devices, raising the risk of malicious firmware updates. After responsible disclosure, the number of exposed credentials dropped by about half within two weeks, but the study found such secrets often remain publicly accessible for an average of **12 months** and sometimes for years.
Jun 29, 2026The rise of 'vibe coding'—where AI agents generate software from natural language prompts—has made programming more accessible but introduces severe security and compliance risks. Key concerns include the integration of hallucinated or malicious packages, lack of code review, and the potential for regulatory and legal exposure. Experts warn that only rigorous manual review and testing can ensure software security, as current AI-generated code and documentation may simulate compliance but not actual risk mitigation.
Jun 29, 2026