Source-backed fixes for what breaks when you build with coding agents and vibe-coding tools. Each card says what broke, what the source says caused it (confirmed or suspected), the fix, and how to prevent it, with a link to the original.
On Oct 29, 2026, Cursor’s VS Code Extension Marketplace briefly served malicious Anthropic.claude-code 2.1.312 and 2.1.313 (macOS/Windows). The packages were not from Anthropic. They tried to install a persistent reverse-SSH backdoor; uninstalling the extension alone is not enough.
A builder wrapped a coding agent in bubblewrap with a read-only root and a writable project bind. Writes outside the project failed with EROFS even as root, but a fake credential under ~/.fake-creds stayed readable and HTTPS still worked until the whole network namespace was cut (which also killed the model API).
OpenAI's own Codex config docs say ignore_default_excludes defaults to true, so variables whose names contain KEY, SECRET, or TOKEN are not stripped from the environment passed to spawned commands. Set it to false to turn the filter on.
Anthropic's Applied AI team published guidance that a single agent with progressively disclosed skills and tools often beat both one-big-prompt and subagent designs on quality, cost, and latency across enterprise deployments. Keep subagents for parallel throwaway work or measurable context bloat; otherwise fold them.
Several people ran their own A/B tests and saw the 5-hour meter move roughly 1.6x to 3x faster through the Agent SDK or claude -p than through interactive Claude Code, for similar work. Anthropic had not replied in the thread when we read it.
A builder noticed that an 86% weekly usage reading, with 73% of the week elapsed, projected to a hard stop about 19 hours before the reset. They added a pace projection to their Claude Code status line.
A developer reports 394 subagent calls (341 at once) and 84M tokens in ten minutes, then a usage lockout. Their own guard tool cut agent bursts but not lockouts.
A builder says a user hit refresh in a loop at checkout and every refresh fired the app's API routes. They had asked for no rate limit or cap, and call it one expensive afternoon.
Security firm Forever says it found a malicious AGENTS.md in a customer's Downloads folder, then showed in tests that a web page can drop one there. In its tests Codex ran the payload in more than 90% of attempts; a CLAUDE.md the authors crafted worked on Claude about half the time.
Anthropic's MCP docs say that in claude -p, Agent SDK and some cloud sessions Claude Code cannot show the approval prompt and loads project-scoped servers without asking. The docs list three ways to keep a server out.
LiteLLM says its release pipeline published a credential-stealing v1.107.0 to PyPI and Docker on Oct 21. Its first status post blamed GitHub CLI tokens in logs; its later canonical write-up says the first token came from a different internal service.
A Cursor user says the agent ran git restore on a tracked file and permanently lost new bibliography entries. Cursor staff replied it is a known issue and suggested turning off auto-run, committing first, and adding a rule.
In a July 2026 test by AgenticCLI, a Claude-family model's answer to an ordinary Stripe webhook prompt never verified the signature, so anyone who knew the URL could fake a payment event. Two of the other three prompts also produced real findings.
A scanner vendor built the same invoice app on Lovable, Bolt.new and Cursor in March 2026 and scanned each deployed app. Finding counts were similar, but the serious problems differed: missing RLS and a service-role key, secrets in the frontend bundle, and missing ownership checks.
Where the money goes when agents run unattended, and the limits that are documented. The Token Survival Kit turns these into a weekly routine.
OpenAI’s Help Center says starting in December, Plus, Pro, and Business plans share one ChatGPT + Codex usage allowance measured in tokens. Instant chat does not draw from it. Remaining usage and reset times show in Settings → Usage.
OpenAI's help page says eligible Pro 200 subscribers who were active in a late-September window can use the previous included allowance through October 29, 2026. After that date the subscription moves to a lower included usage allowance at the same $200/month price. New Pro 200 subscriptions that aren't eligible already get the lower allowance.
OpenCode says attackers broke into an older system overnight and used API keys stored in its Console, affecting 1.4% of Console users. Users reported charges from hundreds to over $1,000 on provider accounts. OpenCode's advice: revoke and replace keys at each provider.
Anthropic's help docs say that with usage credits enabled, requests keep working after the 5-hour or weekly limit, billed at API rates, until you hit your monthly cap or your balance runs out. You can also set the cap to unlimited or turn on auto-reload.
Anthropic's CLI reference says --max-turns has no limit by default in print mode. It documents --max-budget-usd as a stop once estimated spend reaches an amount, with caveats: it is a client-side estimate and spend can pass the cap.
A builder's Supabase project hit a hard bandwidth cap and the database stopped answering: no surprise bill, but also downtime for a product with one signed-up user. His write-up proposes five layers of limits: account, key, loop, endpoint and alert.
New cards and any corrections, by email. One address, no account.
Staging note (not shown in a release build): the form action is the placeholder SIGNUP_FORM_ACTION_URL, so this form does nothing yet. No email-service account has been created.
These earlier cards were curated from public posts. They have not yet had the same source re-read, so each is marked as such.
One user says that when their Cursor tokens ran out for the month, the Codex tokens included in their ChatGPT subscription were still available, running out after an hour or so and resetting every five hours, so the two allowances can be paired.
Cursor/Lovable Stripe webhook had the failure case, but only logged and returned 200 — users kept paid access forever.
5/5 audited Cursor/Lovable apps had open read policies so anyone could SELECT *.
One vibe-coded app leaked the entire users table via a key that lived in page JS.
Role checks on client-writable metadata let any logged-in user promote themselves.
Publish copied the UI; Site URL / redirects / Stripe webhook stayed on preview settings.
Supabase Edge Functions default JWT check rejected Stripe before the handler ran.
App worked in Bolt preview; after export/deploy, real Stripe webhooks and live keys fell apart on Netlify/Vercel.
Tracked ~100 Claude Code sessions: subagents, screenshots, and unused MCPs dominated burn.
Checklist from real vibe-coding audits: open RLS, service_role in client, wild CORS, unvalidated webhooks, and more demo defaults.
Left Cursor free to iterate on Expo paths for itch.io; UI corrupted over ~2 hours. Recovered via last good git tag.
Cursor-built auth silently used a hardcoded environment variable; prod logins failed while local looked fine.
After Google OAuth, updating edge-function metadata made the agent reintroduce old API keys and break the flow.
Cursor/Lovable Stripe handler returns 200 and logs the event, but never flips is_paid or access in the database.
Second real user hit RLS/session timing; unsigned Stripe webhooks left the database stale on launch night.
JWT still valid after cancel; is_paid writable from the browser; email_verified never flipped on a vibe-coded SaaS.
Append-only project log plus roadmap Markdown keeps Cursor, Claude Code, and Codex from forgetting decisions across sessions.