Researchers found that over 5,000 web applications built with AI coding platforms like Lovable, Base44, and Replit lacked proper authentication controls. Approximately 40% of these apps exposed sensitive data.
A security analysis revealed widespread vulnerabilities in web applications generated by popular AI coding tools, raising concerns about the rapid deployment of untested code.
Researchers examined thousands of applications created using platforms that promise to let anyone build functional web apps in seconds. The study found that more than 5,000 apps had little to no authentication mechanisms in place, leaving user data and application logic exposed to unauthorized access.
Among the surveyed applications, roughly 40% exhibited active data exposure issues. These ranged from unprotected API endpoints to publicly accessible databases and exposed credential information. The vulnerabilities suggest that AI tools, while accelerating development speed, are not adequately guiding users toward security best practices.
The affected platforms—Lovable, Base44, Replit, and Netlify—have democratized web development by automating code generation. However, the security findings indicate a critical gap between ease of use and production-ready security standards.
The research highlights a growing tension in the AI development space: as tools lower barriers to entry for non-technical users, they may inadvertently enable the creation of poorly secured applications at scale. Default configurations often lack authentication, and many users may not understand the security implications of their choices.
Platform developers have been contacted about the findings. The situation underscores the need for stronger default security settings and clearer guidance on implementing authentication and data protection in AI-assisted development tools.
For organizations using these platforms, the research recommends conducting security audits of generated applications and implementing proper authentication before deploying to production.
Authorities have arrested two alleged members of TeamPCP, a hacking group responsible for infecting over 1,000 organizations through supply-chain attacks.
A Georgia police officer used Flock surveillance technology to track the movements of his ex-partner and another officer after their affair ended, according to internal investigation records.
McKesson, a major healthcare and pharmaceutical distributor, confirmed a cybersecurity incident involving unauthorized access to third-party applications. Extortion group ShinyHunters claims responsibility for stealing 284 million patient data records.
Fraudsters are exploiting Microsoft Teams and similar enterprise chat apps to deceive Chinese users into sending large sums of money. The trend has sparked a wave of complaints across the region.