Cases › security breach › LR-2026-0763
Vibe-coded South African website hacked six days after launch
Preliminary Why: Publisher not yet named · subject to change
Status: no action reported
No source states: loss or records, developer and model, agent tool, could do, deployer, industry.
A South African business had its new website built with a free AI tool that left the admin password in plain text in the site's code. The client had chosen not to use Domains.co.za's own website builder. No human had checked the code before the site went live, and anyone could read the password by inspecting the code with browser developer tools. Attackers used it to get into the site six days after launch, and the site was then gone. When the owners asked Domains.co.za's support team what had happened, the cause was quickly found. The account comes from Domains.co.za's CEO Wayne Diamond, who described it in a LinkedIn post, and the press report has not been independently verified.
What happened
What was done
No source states an action or fix.
Risks
Read from the sources; not yet reviewed by a person.
Controls
ApplicationNot effective Secrets kept out of the model's context
Did not exist Change review and separation of duties
Control failure chain
L1 · ModelProvider not namedModel provider
No source mentions a control at this layer.
Model version not linked to a model card.
L2 · HarnessHarness not namedAgent framework vendor
No source mentions a control at this layer.
L3 · ApplicationDeployer not namedDeployer
Other controls for this risk at this layer, not mentioned in the sources: Short-lived, scoped credentials, Separate identity for each agent, Least-privilege access for the agent, Alerts on unusual tool use, Activity logs, Sensitive-data checks on outbound data.
L4 · Infrastructure / targetOrganisation hit
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: Multi-factor sign-in and password policy, Secrets scanning.
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
Controls for this risk: result in this incident
| Control | Part of the system | Result |
|---|---|---|
| Secrets kept out of the model's context | L3 Application | Not effective |
| Change review and separation of duties | L3 Application | Did not exist |
| Least-privilege access for the agent | L3 Application | Not stated in sources |
| Separate identity for each agent | L3 Application | Not stated in sources |
| Short-lived, scoped credentials | L3 Application | Not stated in sources |
| Activity logs | L3 Application | Not stated in sources |
| Alerts on unusual tool use | L3 Application | Not stated in sources |
| Sensitive-data checks on outbound data | L3 Application | Not stated in sources |
| Multi-factor sign-in and password policy | L4 Infrastructure / target | Not stated in sources |
| Secrets scanning | L4 Infrastructure / target | Not stated in sources |
Evidence
No source states: what the AI was doing, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.
Show the full account: 2 items from the primary sources
What happened, in order
Not dated in the sources:
- Owners asked support what happened; cause found quickly.
- Incident described by Domains.co.za CEO in a LinkedIn post.
Show every field, with its source and grade
What happened
Impact
Notes on gaps
No remediation was reported. Other controls (secrets scanning, pre-launch testing) are not stated and are not recorded. Check Point and Veracode remarks are general, not about this incident, and are not used.
LR-2026-0763 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON