I Vibe Coded a Security Risk

Was this newsletter forwarded to you? Sign up to get it in your inbox.

“The feature is live lol.”

This sentence is not a combination of words I thought I’d ever use, especially about something I built. That “lol” is a 100 percent organic, all-natural millennial nervous lol. I wasn’t laughing. The agent reviewing my code wasn’t either. It had just told me that the feature I had put into my app had to come down while we figured out whether it had exposed a security problem.

Hi, I’m a baby vibe coder. You’re probably wondering how I got here. The answer is a rich stew of factors: imagination and ignorance, hubris and—because how could it not—AI.

This past January, as Claude Opus 4.5 was blowing everyone’s minds and agent-native architecture was starting to emerge as a new paradigm for building software, I felt the urge to vibe code: What if I built an app designed to work directly with AI agents?

Reader, I did. My app Tastemaker lets you collect clips from writing you admire, describe what you like about them, and generate a style guide from the patterns. Once it appeared to be working, with all the pride of a preschooler bringing her fingerpainting home for mom to put on the fridge, I bought a domain and unleashed it into the world.

The app worked. People could use it. To my astonishment, a handful of people actually did. It became a small, live monument to my multi-hyphenate abilities: proof that I had become a writer-builder with a real-live product, rather than a writer with product ideas.

And then, like a preschooler left alone with her creation and an open bottle of paint, I went and ruined the whole thing.

Researchers at OpenAI have a name for what I was doing as I fiddled with API keys, Supabase (a backend database service I barely understand), and a whole basket of vocabulary words I’d first heard a year ago. They call it task crossover: using AI to do work historically associated with another occupation. In their analysis of more than 800,000 work-related ChatGPT messages, 16.8 percent involved task crossover.

Somewhere, there are marketers debugging websites, small-business owners reviewing contracts, and other writers looking at a working app and thinking: Well, if I can do this, what else can I do?

For me, the answer turned out to be: enough to get myself into trouble.

You can see the appeal. A person with a specific problem no longer has to find the specialist who might solve it, make the case that the problem deserves their time, and wait for it to make its way to the top of their to-do list. AI can help us make something before it gives us the ability to tell whether it is safe or ready for other people.

Let me tell you my tale of woe.

The beginner’s hubris

Tastemaker was a place to collect writing I loved and turn my opinions about it into something I could use. I had spent years doing versions of this manually: copying sentences into notes apps, underlining lines in books, and trying to explain why one paragraph had electricity and another had the emotional texture of an onboarding email.

Then I had one more idea.

I wanted people to connect their Tastemaker profile directly to Claude Code, Codex, or whatever agent they were using, so the agent could retrieve their style guide, once they had one, and add new samples without sending them from their agent back to Tastemaker. The technical word for this, which I was just aware enough of to ask for by name, is an MCP: a way for an AI agent to connect to an outside service. (I want it on the record that I thought of it before I knew we were adding something similar to Every’s writing agent, Spiral.)

The idea made immediate sense, which should perhaps have been my first warning sign. Tastemaker knew what you liked, and your agent was where you did the writing. A direct connection would spare people the annoying trip between the two. I could make the app more useful and more like the kind of sophisticated product I now believed myself to be capable of building.

I’m not an idiot, though. I did ask a friend who is an experienced software engineer whether this was a security nightmare waiting to happen.

He told me that an authenticated API wouldn’t get riskier just because an agent was using it—it only ever does what it’s asked. A backend agent that managed user access was another matter: It decides who gets in, so a wrong or manipulated call could open doors it shouldn’t. It was good advice, but not a security review of what I built.

I took his explanation back to Claude and gave it the rough technical equivalent of: Make sure you do the safe version.

Claude built the connector. It ran its checks. It described the feature as done. I tested it and it worked, and because my coding-toddler brain equated “works” with “is safe,” I said what I’ve come to see as among the most perilous words a vibe coder can say: “Commit and deploy.”

Later, I got access to GPT-5.6 Sol and pointed it at Tastemaker to see what an even newer model would think of my code. I expected criticism of the structure or a recommendation to prune old code.

Instead, it found that the live connector had a public registration route—an open door anyone could walk through—that should not have been public.

Mercifully, there was no evidence that anyone had accessed user data. But the feature was live, the vulnerability waiting to be exploited, and the review found enough risk that Sol asked for permission to shut down the connector and invalidate its active sessions while it was investigated.

I approved it immediately.

Sol offered to build a safer version, but I declined. I had touched the stove and been burned. I needed some time to recover before I could decide if it was safe to touch it again.

When human cognition gets you in trouble

My first instinct was to make this a story about a nontechnical person getting a little too high on her own supply. But I don’t think my own hubris is the whole story—nor do I think I am uniquely susceptible to the siren song of task crossover.

If you asked me, “Are you a security engineer?” I would have said no, of course not. I fell into a much subtler, more dangerous trap: overestimating my own ability to understand. After all, I wasn’t building the feature—Claude was. I was supervising. I could see Claude’s chain of thought and since the words made sense, I thought that I understood the work it was doing. Surely the questions I didn’t know enough to ask had been handled somewhere along the way.

Psychologists have a name for this: the illusion of explanatory depth. The gist is that people feel confident that they understand an ordinary mechanism—right up until they try to explain, step by step, how it works.

AI makes it easy to skip that moment. It gives you the explanation and the code, and the button actually works when you click it. The appearance of “done-ness,” to the untrained eye, becomes evidence of done-ness.

I had tested what I wanted Tastemaker to do: Connect to an agent. It connected to an agent. But I didn’t test whether somebody who was not supposed to connect could do it anyway. I didn’t know that was the question. With the feature working, the unanswered questions felt less urgent. Then they weren’t.

Software-testing research describes a similar pattern. People tend to test what they expect a program to do, rather than looking for the ways it can fail. The path where everything goes right was worth testing. I just took one passing test as proof of things it never checked.

Claude didn’t invent either tendency. But a search engine at least makes you open the links and decide for yourself. Claude turned a half-formed product idea into a running app so fast that I never got the chance to feel intimidated.

Learn to code within limits

My own rules for next time are short. Learn the basic principles of the field I’m entering. Ask a human expert to look for what I’m missing. If AI built the thing, don’t let the same system’s reassurance be the only evidence that it’s ready. Hopefully with these speed bumps in place—with more chances for somebody to say “hold on”—I’ll have a better chance of maintaining a velocity I can responsibly sustain.

And, just to be extra sure I think things through, I’m enlisting AI to help.

I’ve added the following instructions to my AGENTS.md—the file Codex reads first before it takes any action:

Become a paid subscriber to Every to unlock this piece and get Katie’s five-step prompt for making AI agents pause before they do something irreversible.