A vibe-coded site got hacked in 6 days: password left in plain text
A business in South Africa launched a new website and lost it six days later. The cause was not a sophisticated breach. According to Domains.co.za CEO Wayne Diamond, the AI tool used to build the site had left the admin password sitting in plain text inside the source code.
Anyone with a browser and two minutes could open developer tools, read the password, and walk straight in. Diamond described the incident in a LinkedIn post. He noted no human had reviewed the code before the site went live.
“No sophisticated attack. No zero-day exploit. The attackers just read the password and walked in through the front door.” — Wayne Diamond, CEO, Domains.co.za
Attackers scan for AI mistakes at machine speed
Diamond said attackers know which errors AI tools make and run automated scans around the clock looking for them. Ian Jansen van Rensburg, head of security engineering for Africa at Check Point Software, put it plainly: criminals specifically target sites built with tools like Anthropic’s Claude Code and Google’s Gemini. Their own AI tools can read and parse the code behind freshly deployed sites.
“Hackers are using AI, and their attacks are now at the speed of a machine and not a human. These things get exploited very quickly.” — Ian Jansen van Rensburg, Check Point Software
Diamond said AI-generated vulnerabilities can surface within hours of a site going live. At that speed, a weekend deploy with no security review is a real risk.
The broader context
The incident sits inside a fast-moving trend. Microsoft’s AI Diffusion report, published in March 2026, ranks South Africa 46th of 147 economies for generative AI usage, the highest ranking on the continent. Ravi Bhat, commercial solutions and AI officer at Microsoft South Africa, said local AI usage has risen to more than 23%. South Africa, alongside Egypt and Nigeria, counts more than 500,000 developers, and AI coding adoption among that group is climbing.
Rennie Naidoo, research director at Wits Business School, writing for CIO South Africa, described the pattern as vibe coding: accepting AI-generated code with little scrutiny because delivery pressure and a shortage of senior developers make it feel like the only option. He compared it to flying on autopilot without checking the instruments. Research from Veracode and several academic studies, as cited by Naidoo, suggests nearly half of AI-generated code contains known vulnerabilities.
The operator takeaway
If you are shipping anything with AI-generated code, treat it the same way you would treat code from a junior contractor on their first day: read it before it goes live. The AI may have built the feature correctly and left the keys under the mat at the same time.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
