Cases › security breach › LR-2026-0413
Orchids vibe-coding platform zero-click compromise demonstrated to BBC reporter
Preliminary Why: Publisher not yet named · subject to change
Status: no action reported
No source states: loss or records, developer and model, agent tool, could do, deployer.
Severity moderate: Test: data or systems of others touched with a bounded scope stated. Fact: the attacker accessed one journalist's project and computer, a bounded scope; no regulator or count of affected parties is stated.
Orchids is a vibe-coding tool that lets people without technical skills build apps and games by typing prompts into a chatbot. A BBC reporter asked it to build a game based on the BBC News website, and a researcher, Etizaz Mohsin, exploited an undisclosed weakness to access the project and edit its code. He added a line of code that, according to the BBC, gave him access to the reporter's computer, where a notepad file appeared and the wallpaper changed. The attack needed no action from the victim. Mohsin said he found the flaw in December 2025 and spent weeks trying to warn the company, which later replied that it had possibly missed his messages. The BBC reported that the flaw remained unfixed.
What happened
What was done
No source states an action or fix.
Risks
Read from the sources; not yet reviewed by a person.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
ApplicationVulnerability scanning of AI components · Adversarial testing before deployment · Short-lived, scoped credentials · Live behaviour monitoring · AI incident response plan · Segmentation of agent components · Encryption of stored data
Infrastructure / targetKnown flaws patched · Intrusion and endpoint detection · Inventory of exposed services
Similar incidents
Evidence
No source states: how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.
Show the full account: 8 items from the primary sources
What happened, in order
- 2025-12 Researcher Etizaz Mohsin found the flaw while experimenting with vibe-coding.
- 2026-02-13 The BBC published its account, stating the risk was unfixed.
Not dated in the sources:
- The researcher spent weeks trying to contact the company about the flaw.
- The BBC reporter started a vibe-coding test project asking Orchids to build a game based on the BBC News website.
- The researcher exploited the weakness to access and edit the project code.
- The researcher added a line of code to the project without the reporter's knowledge.
- Shortly afterwards a notepad file appeared on the reporter's desktop and the wallpaper changed.
- The Orchids team replied to the researcher, saying it had possibly missed his warnings.
Show every field, with its source and grade
The AI system
What happened
Impact
Context
Notes on gaps
The exact vulnerability was not disclosed. Orchids did not respond to press requests for comment and no remediation is reported. The 'I5' and 'J1' links are my mapping of the company's reported failures to controls, not controls the sources name. The BBC account is used as the best source; it is a press source, and the InformationWeek piece relies on it.
LR-2026-0413 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON