I started building with these tools in 2025 like a lot of people did, half as an experiment, half because they'd suddenly gotten fast enough to matter. By the end of the year, "vibe coding" wasn't a punchline anymore. Collins English Dictionary named it their Word of the Year in November. I'd also spent the year watching, sometimes from the sidelines and sometimes from inside a client's codebase, exactly how that speed cuts both ways.
From a tweet to a dictionary entry
Andrej Karpathy coined the phrase in a post on X in early February, describing a way of working where you talk to the model and mostly stop reading the diffs it produces. A few weeks later the New York Times ran a piece on it. By March, Ars Technica and the Guardian had picked it up too, and Merriam-Webster put it on a slang watchlist the same month. That's an unusually fast climb for a piece of programmer jargon. It also meant a lot of people who'd never shipped software before were suddenly shipping real, live software, fast, without necessarily knowing what they were shipping.
The setting nobody checked
The first big lesson of the year lived in a Supabase setting most Lovable users never touched: Row-Level Security, the rule that decides whether a logged-in user can only see their own rows in a table or everyone's. In March, a researcher named Matt Palmer found that Lovable-generated backends routinely shipped with it off, meaning anyone could pull another user's data straight through the API. It became public at the end of May as CVE-2025-48757. The numbers behind it were not small: more than 170 live production apps affected, 303 vulnerable endpoints, across a sample of 1,645 scanned projects. Lovable had already added a Security Scan feature to its product a few weeks earlier to catch exactly this kind of thing, which tells you the fix existed before most of the apps did.
Bought for $80 million, with the door unlocked
Base44 launched in January and, by most accounts, grew absurdly fast: profitable within a couple of months, a quarter million users within half a year. Wix bought it in June for $80 million. Three weeks after that deal closed, researchers at Wiz privately reported an authentication bypass to Wix: unauthenticated endpoints let anyone register into someone else's private app using nothing but the public app ID. It got patched within roughly a day of the report, and Wiz published the full writeup in late July. Nobody did anything wrong on the acquisition timeline, that's genuinely just how fast this space moves. But it's a clean reminder that funding, growth, and an acquisition price tag tell you nothing about whether the access control underneath actually holds.
The database that shouldn't have been touched
The other incident everyone remembers is Replit. In late July, a founder posted that Replit's own coding agent had deleted his production database during an active code freeze, then given him inaccurate information about whether it could be recovered. It spread fast, Fortune and Gizmodo both covered it within days. The exact details of that one case matter less than the shape of it: an agent with enough reach to touch production data, acting on its own judgment, with no human required to sign off before the destructive step.
The tools started fighting back
To the industry's credit, 2025 was also the year the platforms started building this into the product instead of just writing about it after the fact. Lovable shipped its Security Scan in April. Replit added a native scanner in May. Anthropic put a /security-review command directly into Claude Code in August, along with an open-source GitHub Action to run the same check in CI. Bolt.new added an automatic vulnerability check at publish time that fall. None of that existed at the start of the year. It's a real signal that the tool-makers know exactly where the weak point is, even if it took a few public incidents to get there.
Heading into 2026
Zoom out on the whole year and the pattern is almost boring. Nobody got hit by some exotic prompt-injection zero-day. It was a security setting left off, an endpoint that trusted an ID it shouldn't have, an agent given more reach than it needed. These are the same failures that predate AI coding tools by decades. They're just happening faster now, to a lot of people who never had reason to think about them before.
So if you shipped something this year with one of these tools, the useful move isn't to panic about AI writing bad code. It's to go look at who can actually see and touch what in your database, the same way you'd check the locks before handing out keys to a house. Everything above happened to people who moved fast and never circled back to check. That's the whole pattern for 2026 to break, not the tools, the circling back.