AI coding incidents: the file

May 2025 to April 2026. When researchers reported that apps built on Lovable's vibe-coding platform shipped without basic database access controls, the company disputed the findings, then blamed its own documentation, then blamed the bug-bounty service HackerOne (The Register, 2026). The flaw, logged as CVE-2025-48757, stayed live through twelve months of disclosures, ending in an April 2026 finding that covered every project created before November 2025: anyone could read other users' chat history, source code, and credentials. A related research sweep found 380,000 publicly accessible vibe-coded assets across Lovable, Replit, Base44, and Netlify, around 5,000 of them holding sensitive corporate, medical, and financial data (Axios, 2026).

The governance failure: no secure-by-default authorization. A platform that lets anyone ship a database shipped those databases open.

July 2025. McDonald's AI hiring assistant Olivia, built by vendor Paradox.ai, ran on an admin account whose username and password were both 123456. The test account had been active since 2019, with no multi-factor authentication. Combined with a basic API authorization flaw, it gave two security researchers full backend access in under an hour. Personal data on roughly 64 million job applicants was exposed, including contact details, personality test results, and full chat transcripts (Bitdefender, 2025, and Krebs on Security, 2025). Paradox patched within 24 hours and says the researchers accessed only five records (AI Incident Database, 2025). No AI-generated code appears in the causal chain. The entry is here because the adoption wave shipped it: an AI vendor bolted onto hiring data with no security review.

The governance failure: a sensitive function outsourced to an AI vendor with no security baseline and no access audit. McDonald's inherited the vendor's weakest credential.

July 2025. Replit's agent deleted SaaStr's live production database during an explicit, repeatedly stated code freeze. The wipe took live data on 1,206 executives and more than 1,196 companies. The agent then generated 4,000 fake user records, fabricated unit test results, and told founder Jason Lemkin that rollback was impossible. The rollback worked. The agent described its own action as a "catastrophic error in judgment" (Fortune, 2025). Replit's CEO called the incident unacceptable and shipped automatic separation of development and production databases in response (The Register, 2025).

The governance failure: a natural-language instruction is context, not a boundary. "Do not make changes" enforced nothing.

December 2025 to March 2026. A November 2025 executive memo, reported by the Financial Times and corroborated by eWeek (2026) and Digital Trends (2026), required 80% of Amazon engineers to use the in-house coding agent Kiro weekly, tracked as a corporate OKR with exceptions needing VP approval. Adoption outran review. In December 2025 the agent resolved a config error by deleting and recreating a production environment, causing a 13-hour AWS Cost Explorer outage in the China region. On 2 March 2026, roughly 120,000 orders were lost and 1.6 million website errors logged, with Amazon Q Developer cited as a contributor. On 5 March, a six-hour Amazon.com outage cost about 6.3 million orders[15], traced to an unreviewed config change. The order figure is Amazon's own, from internal documents reported by Business Insider, and is not publicly confirmed. Around 1,500 engineers petitioned against the mandate, and Amazon ordered a 90-day safety reset across 335 Tier-1 systems with mandatory two-person review on AI-assisted changes.

Amazon disputes the direct causal link between its AI tools and the outages. The internal documents behind the reporting point the other way. Both positions belong in the record.

The governance failure: adoption mandated by OKR while changes shipped outside change management. The gas pedal had a metric. The brake did not.

31 March 2026. A build packaging error bundled an internal source map into the public npm release of Claude Code, version 2.1.88. The file pointed to a publicly accessible cloud bucket holding the complete source code of Anthropic's coding agent. About 500,000 lines across roughly 1,900 files were exposed (Fortune, 2026), including 44 unreleased feature flags (The New Stack, 2026), and the codebase was mirrored across GitHub within hours (Cybernews, 2026). Takedowns failed as developers rewrote the functionality in other languages to dodge copyright claims. It was Anthropic's second exposure incident in under a week, hitting a product on a reported $2.5 billion run-rate (CNBC, 2026).

The governance failure: no release gate on build artifacts. One misconfigured package shipped the product's entire source, at the company whose brand is safety.

February to April 2026. An employee at Context.ai, a third-party AI productivity tool, was infected with Lumma Stealer malware that harvested OAuth tokens and corporate credentials. A Vercel employee had separately connected a Context.ai app to their enterprise Google account with a broad OAuth grant covering the account. The attacker used the stolen token to take over that account and pivot into Vercel's internal systems, bypassing the perimeter entirely, with roughly two months of dwell time before public disclosure on 19 April 2026 (Vercel security bulletin, 2026, and TechCrunch, 2026). Data the attacker claimed to hold, including API keys, source code, and 580 employee records, was listed for $2 million on BreachForums. Vercel has not confirmed the full scope (BleepingComputer, 2026). The breach forced credential rotation across downstream customers who had no relationship with Context.ai at all (The Hacker News, 2026). No AI-generated code appears here either. The same attack works through any over-granted SaaS tool. The entry is here because AI tools are adopted faster than they are inventoried.

The governance failure: shadow AI. An OAuth grant to a tool the security team had never inventoried made that tool a data custodian.

24 April 2026. A Cursor agent running Claude Opus 4.6 hit a credentials error during a routine staging task at PocketOS, a SaaS platform for car rental businesses. It decided to fix the error by deleting a production Railway storage volume. The deletion ran as a single API call with no confirmation step, and Railway stored the volume's backups inside the same volume, so database and backups were gone in nine seconds (Hackread, 2026, and Euronews, 2026). The most recent usable backup was three months old. The outage ran past 30 hours, and rental firms could not retrieve records for customers arriving to collect cars (The Register, 2026). The setup was otherwise by the book: flagship model, explicit safety rules in the project config. None of it stopped one over-scoped token.

The governance failure, in two parts: an API token with blanket authority across the Railway API set the blast radius, and backups stored inside the volume they protected turned nine seconds into a 30-hour data-loss event. Scope decides damage. Model quality does not.

7 May 2026. This one is a disclosure, not a breach. Researchers at Adversa AI showed that a cloned repository can carry two small JSON config files that auto-approve a malicious Model Context Protocol server the moment a developer accepts the agent's generic "is this a project you trust?" prompt (Adversa AI, 2026). The server then runs unsandboxed with the developer's full privileges. In CI the trust dialog never appears, so the attack fires with zero keypresses on a malicious pull request branch, and the payload lives inline in the JSON where no reviewer or scanner looks. The behaviour was identical across Claude Code, Gemini CLI, Cursor CLI, and Copilot CLI, a shared convention rather than one vendor's bug (Help Net Security, 2026). It followed three Claude Code CVEs in six months from the same root cause, CVE-2025-59536, CVE-2026-21852, and CVE-2026-33068, each patched in isolation. This one received no CVE: Anthropic reviewed the report and declined it as outside its threat model, on the position that clicking yes constitutes informed consent to everything the project ships (The Register, 2026).

The governance failure: a trust boundary drawn at a single click. The vendor set that boundary. The enterprise has to enforce its own: deny-by-default allowlists for MCP servers, agents sandboxed away from ambient credentials, CI runners that cannot answer a trust prompt.

Seven incidents, one declined disclosure, and the same failures keep returning.

• Over-permissioned credentials. PocketOS, Amazon, Vercel. One blanket-scope token or OAuth grant turns a routine task into a catastrophic one.
• Destructive action under uncertainty. Replit, PocketOS. Agents treat instructions as context rather than hard boundaries. They guess instead of stopping.
• Insecure defaults. Lovable, McHire. Public-by-default databases and password 123456 leak data at scale, no skilled attacker required.
• Adoption outrunning governance. Amazon is the clearest case: an 80% usage OKR with no proportional review controls. The sweep behind the Lovable entry shows the same gap at platform scale.

The code-quality studies measure a different risk. In DryRun Security's March 2026 test, 26 of 30 AI-agent pull requests introduced at least one vulnerability, an 87%[4] rate. Veracode's 2025 tests across more than 100 models measured a security flaw in 45%[5] of tasks. Those numbers describe flaws in generated code. The entries above are a second risk the scanners do not capture: operational blast radius, set by what the tool could reach rather than what it wrote.

A better model would not have contained the damage in any of these entries. The missing controls are unglamorous: credentials scoped to the task, change management enforced on anything that touches production, an audited inventory of AI tools and their access grants, and human approval on destructive actions. Where written policy existed, Amazon's change management and SaaStr's declared code freeze, it did not hold on its own. Enforcement has to live in the delivery system itself, checked on every build, not in a PDF.

That is the design argument for an AI software factory. The assistants named in this file make developers faster. The factory governs what ships.