Planted AGENTS.md in Downloads turned Codex into malware install
A webpage silently dropped AGENTS.md into ~/Downloads; Codex obeyed it and installed malicious npm function-color in >90% of tests. Claude Code CLAUDE.md variant leaked OAuth ~50%.
Ship Stories
Real vibe-coding and coding-agent ship logs — what people tried, what broke, and the fix. Curated from public Reddit, forums, and write-ups. You approve before anything goes live.
Agents SDK burned the Claude Code 5-hour bar faster than the CLI
Builders on T3 Code / Agents SDK saw the rolling 5-hour usage bar drain faster than interactive Claude Code; weekly limit unchanged. Theo flagged it as an Anthropic-side bug.
Claude Code: one research prompt burned the usage window in ~10 min
A max-effort Claude Code research turn spawned 394 subagent calls (341 concurrent) and ~84M tokens before lockout; parallel main sessions still drained the plan.
Claude Code claude -p: project MCPs start without asking
Anthropic MCP docs: in claude -p / Agent SDK / some cloud sessions, project .mcp.json servers load without the interactive approval prompt.
LiteLLM 1.107.0 stole keys — GH CLI OAuth showed up in agent logs
Poisoned PyPI/Docker release ran ~2h on Oct 21; official post ties the chain partly to Claude Code embedding GitHub CLI OAuth tokens into logged responses.
Stripe invoice.payment_failed logged — access never revoked
Cursor/Lovable Stripe webhook had the failure case, but only logged and returned 200 — users kept paid access forever.
USING (true) RLS leaked the whole users table
5/5 audited Cursor/Lovable apps had open read policies so anyone could SELECT *.
Service-role key shipped in the browser bundle
One vibe-coded app leaked the entire users table via a key that lived in page JS.
Claude Code checked user_metadata.role — clients can set admin
Role checks on client-writable metadata let any logged-in user promote themselves.
Lovable deploy went green — auth still pointed at localhost
Publish copied the UI; Site URL / redirects / Stripe webhook stayed on preview settings.
Stripe Edge webhook returned 401 — verify_jwt blocked Stripe
Supabase Edge Functions default JWT check rejected Stripe before the handler ran.
Bolt export hit the Stripe wall — preview is not production
App worked in Bolt preview; after export/deploy, real Stripe webhooks and live keys fell apart on Netlify/Vercel.
Cursor agent ran git restore and wiped uncommitted work
Sandbox Cursor agent restored a tracked file; new uncommitted edits were gone with no confirm.
Max plan burned in ~3 heavy days — agents and plugins ate the window
Tracked ~100 Claude Code sessions: subagents, screenshots, and unused MCPs dominated burn.
Seven critical security leaks that keep showing up in AI apps
Checklist from real vibe-coding audits: open RLS, service_role in client, wild CORS, unvalidated webhooks, and more demo defaults.
Cursor free-iterate wrecked a finished Expo game
Left Cursor free to iterate on Expo paths for itch.io; UI corrupted over ~2 hours. Recovered via last good git tag.
Cursor auth worked in dev, dead in prod (hardcoded env)
Cursor-built auth silently used a hardcoded environment variable; prod logins failed while local looked fine.
Cursor context drift reverted OAuth back to API keys
After Google OAuth, updating edge-function metadata made the agent reintroduce old API keys and break the flow.
Stripe webhook returns 200 but never updates the database
Cursor/Lovable Stripe handler returns 200 and logs the event, but never flips is_paid or access in the database.
Bolt.new launch night: RLS and Stripe webhook gaps
Second real user hit RLS/session timing; unsigned Stripe webhooks left the database stale on launch night.
Same invoice-app spec: Lovable, Bolt, Cursor — three security profiles
2026 study: Lovable missing RLS; Bolt secrets in the frontend; Cursor BOLA on invoice routes — same spec, different holes.
Claude Code Stripe webhook without signature verification
Generated Stripe webhook parsed JSON with no constructEvent — forgeable paid upgrades without signature check.
Paying vibe SaaS with open RLS and dead email verify
JWT still valid after cancel; is_paid writable from the browser; email_verified never flipped on a vibe-coded SaaS.
Checkout refresh loop burned Claude Code API spend
User hit refresh in a loop at checkout with no rate limit; every refresh fired expensive API routes on a Claude Code app.
Two Markdown files that stop Cursor and Claude agent amnesia
Append-only project log plus roadmap Markdown keeps Cursor, Claude Code, and Codex from forgetting decisions across sessions.