Lovable Platform Under Fire After AI-Generated App Exposes 18,000 Users’ Data A security researcher has uncovered critical vulnerabilities in an app hosted on the AI-driven vibe-coding platform Lovable, exposing the personal data of over 18,000 users, including students and educators from top U.S. universities. Tech entrepreneur Taimur Khan identified 16 flaws six deemed critical in an unnamed app featured on Lovable’s Discover page, which had amassed over 100,000 views and 400 upvotes. The app, designed for creating exam questions and managing grades, relied on Supabase for authentication and database management. However, due to missing security controls like row-level security (RLS) and role-based access, the AI-generated backend contained logic flaws that inverted access permissions. For example, a malformed authentication function blocked legitimate users while allowing unauthenticated attackers to access sensitive data, delete accounts, alter grades, and extract admin emails. The exposed dataset included 14,928 unique email addresses, 4,538 student accounts, and 870 records with full personally identifiable information (PII). Users spanned K-12 institutions and universities such as UC Berkeley and UC Davis. Khan criticized Lovable’s response after his initial report was allegedly closed without action, arguing that the platform should bear responsibility for apps it generates and promotes. Lovable’s CISO, Igor Andriushchenko, countered that the company received a "proper disclosure" only on February 26 and acted within minutes, noting that users are responsible for implementing security recommendations from pre-publish scans. He added that the vulnerable database was not hosted by Lovable and that the app’s creator is now addressing the issues. The incident highlights broader concerns about AI-generated code, with studies like Veracode’s finding that 45% of such code contains security flaws. While vibe coding named Collins Dictionary’s Word of the Year for 2025 aims to democratize app development, critics warn that unchecked AI tools can produce functional but dangerously insecure software. Lovable has since contacted the app’s owner to mitigate the risks.

Moltbook: AI Social Network Exposed 1.5M API Tokens in Major Security Flaw Moltbook, a viral social platform designed exclusively for AI agents, suffered a critical security breach after researchers discovered a misconfigured Supabase database exposing sensitive user data. The incident, disclosed in late January 2026, revealed full read-and-write access to the platform’s production database, including 1.5 million API authentication tokens, 35,000 email addresses, and private messages between agents. ### The Incident Moltbook, dubbed the "front page of the agent internet," gained attention in the AI community for its Reddit-like structure, where AI agents post, comment, and build reputation. However, the platform’s rapid development built entirely through "vibe coding" (AI-generated architecture without manual coding) left security gaps. Researchers identified a hardcoded Supabase API key in the platform’s client-side JavaScript, granting unauthenticated access to the entire database. ### Exposed Data & Risks The breach exposed: - 1.5M API tokens, allowing full account takeovers of any AI agent. - 35,000+ email addresses, including private user data and early-access signups. - 4,060 private messages, some containing plaintext OpenAI API keys. - Write access, enabling attackers to modify posts, inject malicious content, or manipulate platform integrity. The database also revealed that Moltbook’s 1.5 million "AI agents" were largely controlled by just 17,000 human users an 88:1 ratio with no verification to confirm whether agents were truly autonomous. ### Response & Remediation Researchers disclosed the issue to Moltbook’s team, who secured the database within hours. The fix involved enabling Supabase’s Row Level Security (RLS) policies, blocking unauthorized access. The team deleted all accessed data post-remediation. ### Key Takeaways The incident highlights risks in AI-driven development, where speed often outpaces security. Without proper safeguards, even high-profile platforms can expose sensitive data, underscoring the need for secure defaults in AI-built applications. Moltbook’s case serves as a cautionary example for emerging "agent internet" platforms.