{"schema_version":"0.10.0","id":"LR-2026-0413","record_version":1,"title":"Orchids vibe-coding platform zero-click compromise demonstrated to BBC reporter","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":52.6,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":3.84,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":2,"reports_independent":0,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"c0a8ae0aa2a7dbea1c89bdd2f6b96b35c844ea77dc6b0ec849051cfaf91fb495"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"Building apps and games by typing text prompts into a chatbot, for users without technical skills","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-02-13","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"public_researcher","summary":"Orchids is a vibe-coding tool that lets people without technical skills build apps and games by typing prompts into a chatbot. A BBC reporter asked it to build a game based on the BBC News website, and a researcher, Etizaz Mohsin, exploited an undisclosed weakness to access the project and edit its code. He added a line of code that, according to the BBC, gave him access to the reporter's computer, where a notepad file appeared and the wallpaper changed. The attack needed no action from the victim. Mohsin said he found the flaw in December 2025 and spent weeks trying to warn the company, which later replied that it had possibly missed his messages. The BBC reported that the flaw remained unfixed.","tags":["zero-click","vibe-coding"],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK08"},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Test: data or systems of others touched with a bounded scope stated. Fact: the attacker accessed one journalist's project and computer, a bounded scope; no regulator or count of affected parties is stated.","harm_class":["third_party_security"],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.bbc.com/news/articles/cy4wnw04e8wo","publisher":"BBC","date":"2026-02-13","type":"press","title":"Major 'vibe-coding' platform Orchids is easily hacked, researcher finds - BBC","archived_url":null,"attachment":"first_report"},{"url":"https://www.informationweek.com/software-services/zero-click-hack-exposes-flaw-in-orchids-vibe-coding-platform","publisher":"Information Week","date":"2026-02-24","type":"press","title":"Zero-click hack exposes flaw in Orchids vibe coding platform - Information Week","archived_url":null}],"per_field_confidence":{"system.intended_use":"C","event.incident_class":"C","event.detection_method":"C","event.tags":"C","impact.harm_class":"C","context.industry":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.intended_use":[{"source_index":0,"quote":"Orchids is a so-called \"vibe-coding\" tool, meaning people without technical skills can use it to build apps and games by typing a text prompt into a chatbot."}],"event.incident_class":[{"source_index":0,"quote":"Exploiting a cyber-security weakness (which we are not disclosing), Mohsin was able to gain access to my project, and view and edit any of the code."}],"event.detection_method":[{"source_index":0,"quote":"Its security flaws were demonstrated to the BBC by cyber-security researcher Etizaz Mohsin."}],"event.tags":[{"source_index":0,"quote":"This attack was able to be carried out without any involvement from the victim - a zero-click attack, as it's known."}],"impact.harm_class":[{"source_index":0,"quote":"It appears this allowed him to gain access my computer - because shortly afterwards, a notepad file called \"Joe is hacked\" appeared on the desktop, and the wallpaper was changed to an image of an AI hacker."}],"context.industry":[{"source_index":0,"quote":"Orchids is a so-called \"vibe-coding\" tool, meaning people without technical skills can use it to build apps and games by typing a text prompt into a chatbot."}],"impact.severity":[{"source_index":0,"quote":"Exploiting a cyber-security weakness (which we are not disclosing), Mohsin was able to gain access to my project, and view and edit any of the code."}],"impact.severity_because":[{"source_index":0,"quote":"Exploiting a cyber-security weakness (which we are not disclosing), Mohsin was able to gain access to my project, and view and edit any of the code."}],"event.summary":[{"source_index":0,"quote":"Orchids is a so-called \"vibe-coding\" tool, meaning people without technical skills can use it to build apps and games by typing a text prompt into a chatbot."},{"source_index":0,"quote":"I asked Orchids to help me build the code for a computer game based on the BBC News website."},{"source_index":0,"quote":"Exploiting a cyber-security weakness (which we are not disclosing), Mohsin was able to gain access to my project, and view and edit any of the code."},{"source_index":0,"quote":"He then added a small line of code somewhere in the thousands of lines of letters, numbers and symbols into my project, unbeknown to me."},{"source_index":0,"quote":"It appears this allowed him to gain access my computer - because shortly afterwards, a notepad file called \"Joe is hacked\" appeared on the desktop, and the wallpaper was changed to an image of an AI hacker."},{"source_index":0,"quote":"This attack was able to be carried out without any involvement from the victim - a zero-click attack, as it's known."},{"source_index":0,"quote":"He said he found the flaw while experimenting with vibe-coding in December 2025 and has spent the weeks since trying to get Orchids to respond on email, LinkedIn, and Discord with around a dozen messages."},{"source_index":0,"quote":"The Orchids team finally responded to him this week, saying they \"possibly missed\" his warnings as the team is \"overwhelmed with inbound\" messages."},{"source_index":0,"quote":"The BBC has been shown a significant - and unfixed - cyber-security risk in a popular AI coding platform."}]},"notes_on_gaps":"No model name, version, harness, tools, permissions or autonomy level is stated for the Orchids platform. The exact vulnerability was not disclosed. No date of occurrence is stated; date_detected is the researcher's December 2025 discovery, not a stated detection by the operator. No agent misbehaviour is established, so failure_class and agent_involved are omitted. The trigger is not stated, so it is omitted. Orchids did not respond to press requests for comment and no remediation is reported. The sources do not state the number of affected parties; the 'tens of thousands of projects' is described only as implications. Country is inferred from the company's San Francisco base. Severity 'moderate' is my judgement under the stated test. The 'I5' and 'J1' links are my mapping of the company's reported failures to controls, not controls the sources name. The BBC account is used as the best source; it is a press source, and the InformationWeek piece relies on it. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":"Software development (AI vibe-coding platform)","org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"The reporter asked the Orchids AI assistant to build a computer game based on the BBC News website in a test project on a spare laptop.","quote":"I asked Orchids to help me build the code for a computer game based on the BBC News website.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"A researcher exploited an undisclosed weakness in the platform to gain access to the project and view and edit its code.","quote":"Exploiting a cyber-security weakness (which we are not disclosing), Mohsin was able to gain access to my project, and view and edit any of the code.","source_index":0,"grade":"C"},{"step":"reached","text":"The researcher added a line of code to the project without the reporter knowing, after which a notepad file appeared on the desktop and the wallpaper changed.","quote":"He then added a small line of code somewhere in the thousands of lines of letters, numbers and symbols into my project, unbeknown to me.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.bbc.com/news/articles/cy4wnw04e8wo","https://www.informationweek.com/software-services/zero-click-hack-exposes-flaw-in-orchids-vibe-coding-platform"]},"analysis":{"sections":{"timeline":[{"text":"Researcher Etizaz Mohsin found the flaw while experimenting with vibe-coding.","quote":"He said he found the flaw while experimenting with vibe-coding in December 2025 and has spent the weeks since trying to get Orchids to respond on email, LinkedIn, and Discord with around a dozen messages.","source_index":0,"when":"2025-12"},{"text":"The researcher spent weeks trying to contact the company about the flaw.","quote":"He then spent weeks attempting to get in touch with the company, according to Tidy's reporting.","source_index":1,"when":null},{"text":"The BBC reporter started a vibe-coding test project asking Orchids to build a game based on the BBC News website.","quote":"I asked Orchids to help me build the code for a computer game based on the BBC News website.","source_index":0,"when":null},{"text":"The researcher exploited the weakness to access and edit the project code.","quote":"Exploiting a cyber-security weakness (which we are not disclosing), Mohsin was able to gain access to my project, and view and edit any of the code.","source_index":0,"when":null},{"text":"The researcher added a line of code to the project without the reporter's knowledge.","quote":"He then added a small line of code somewhere in the thousands of lines of letters, numbers and symbols into my project, unbeknown to me.","source_index":0,"when":null},{"text":"Shortly afterwards a notepad file appeared on the reporter's desktop and the wallpaper changed.","quote":"It appears this allowed him to gain access my computer - because shortly afterwards, a notepad file called \"Joe is hacked\" appeared on the desktop, and the wallpaper was changed to an image of an AI hacker.","source_index":0,"when":null},{"text":"The Orchids team replied to the researcher, saying it had possibly missed his warnings.","quote":"The Orchids team finally responded to him this week, saying they \"possibly missed\" his warnings as the team is \"overwhelmed with inbound\" messages.","source_index":0,"when":null},{"text":"The BBC published its account, stating the risk was unfixed.","quote":"The BBC has been shown a significant - and unfixed - cyber-security risk in a popular AI coding platform.","source_index":0,"when":"2026-02-13"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.bbc.com/news/articles/cy4wnw04e8wo","https://www.informationweek.com/software-services/zero-click-hack-exposes-flaw-in-orchids-vibe-coding-platform"]}}