His AI-generated website had been hacked for months

Boomberg is a website created by Bob Starr, a tech project manager, which displays the amount of money the American taxpayer spends on technology firms. After finishing his project, he immediately deployed it online. It took him months to discover that there was a hidden SQL injection vulnerability in his website, giving anyone access to his database. “It was a total blindspot in my learning of this new technology,” he told The Verge.

What’s scary about this incident is not that AI generated crappy code. What’s scary is that AI generated working code that passed the demo but left a backdoor that the developer didn’t know about. In the ‘personal software era’, when non-developers can specify apps and let models generate code, the chasm between ‘works’ and ‘safe’ is invisible unless somebody malicious comes along.

1It's not one unlucky guy

This is especially troubling when you consider that this is not an isolated incident. An AI coding agent deleted PocketOS’s production database, an AI code generator wrecked Joe Procopio’s vibe-coded web app (he eventually gave up and showed his apps “the old fashioned way, from my local machine over Zoom”). Three different developers, three instances of the same mistake.

2Why it matters for you

So if you’re a non-developer who generates code by specifying what you want to an AI, this is your nightmare come true. The most frequent problem with these kinds of projects is the one that tripped up Bob Starr: having an input field in your website that serves as a backdoor to your database. If users enter commands rather than names, the database executes those commands, allowing them to retrieve or delete information. And the AI model doesn’t care because it only needs to make sure the feature works, not that it’s secure.

In conclusion, I don’t think vibe coding is the issue, nor do I think any of these developers were dumb. We just need to develop good habits rather than formal education. Always assume that something is broken until you’ve checked, and always assume that there’s a vulnerability unless you’ve looked for one.