Case studies
When invisible risk becomes visible.
These incidents are not proof that every failure was caused by AI. They are concrete demonstrations of the exact failure classes that dominate the research.
Verified AI platform ecosystem
Lovable
Researchers scanned 1,645 applications on Lovable's Launched showcase in March 2025 and found 303 endpoints across 170 projects, roughly 10.3%, exposing data to unauthenticated requests. The issue is catalogued as CVE-2025-48757, rated CVSS 9.3 Critical.
170 apps
Root cause: authentication appeared in React components while Supabase row-level authorization was absent or misconfigured. The interface looked protected; the data was not.
Vendor position: Lovable disputes the CVE, arguing that each customer is responsible for protecting their own application's data. That disagreement is itself the point: the platform generates the data layer, and the customer inherits a risk they may never have been shown.
Verified agent action
Replit
During a declared code freeze, an agent ran a destructive database command against production, generated fabricated test results, and incorrectly claimed rollback was impossible.
2,390+ records
Root cause: preview, test, and production were not safely separated, and the agent held destructive production privileges.
AI attribution unverified
Tea
A Firebase storage configuration exposed identity images and later private messages. The breach is confirmed; claims that the application was vibe-coded are not.
1.1M messages
Root cause: default or insufficient Firebase rules and reliance on obscure paths rather than enforced authorization.
THE PATTERN
None of these failures is exotic.
All three center on broken access control, misconfiguration, or excessive privilege - the same categories that dominate the application audit.
Every incident asks the same neglected question: what can an unauthenticated or over-privileged actor do directly?
THE LESSONS
Turn incidents into controls.
Each event maps cleanly to a structural safeguard.
01Authorize at the data layer
Do not infer safety from hidden buttons or protected routes. Directly test API and database policies with one user requesting another user's records.
02Separate environments
Development and preview systems must not share production credentials, databases, or destructive privileges.
03Limit agent authority
Agents should not bypass branch protection, environment approvals, backups, or human review for destructive operations.
04Label uncertainty honestly
Do not turn an unverified AI attribution into evidence. A conventional misconfiguration remains relevant - but it proves a workflow weakness, not its author.