Vibe’s South African Website Breached Just Days After Debut

Wayne Diamond, the CEO of Domains.co.za, disclosed that a client’s new website was compromised just six days after its launch.

The client utilized a widely-known AI tool to create the site, which made a significant error that went unchecked by a person, resulting in an insecure site.

This incident underscores the dangers associated with AI-generated code as South Africa emerges as a leader in generative AI adoption, currently ranking 46th among 147 economies worldwide as of March 2026.

“Our latest AI Diffusion report findings show that AI is moving rapidly from experimentation to practical, everyday use,” stated Ravi Bhat, Commercial Solutions and AI Officer at Microsoft South Africa.

“For South Africa, the rise in local AI usage to over 23% is encouraging progress,” Bhat mentioned in a report from AI Impact.

The same report highlighted that South Africa boasts over 500,000 developers, ranking alongside Egypt and Nigeria, with an increasing use of AI among this group.

These developers are turning to readily available AI tools like Anthropic’s Claude Code to assist them in their projects, accelerate coding processes, and troubleshoot issues.

“Under relentless delivery pressure and a persistent shortage of senior developers, these AI companions seem like the perfect solution,” said Rennie Naidoo, research director at Wits Business School.

“Beneath the surface of this transformation lies a mounting concern that speed is seducing us into complacency, and that convenience is coming at the cost of security, reliability and deep understanding.”

Naidoo described “vibe coding” as the increasing inclination among developers to accept AI-generated code with little to no examination, relying on it to function without checking for errors.

“Like flying on autopilot without checking the instruments, it works brilliantly until it doesn’t. The risk isn’t hypothetical,” he noted in a blog post for CIO South Africa.

“Research from Veracode and multiple academic studies shows that nearly half of AI-generated code contains known vulnerabilities.”

In a recent LinkedIn post, Diamond explained how a client’s website was breached after they opted to use an AI tool to create it.

“They’d chosen not to use our website builder. They’d built the site themselves with one of the popular AI tools: free and impressive,” Diamond noted.

“It looked great and sort of worked. I say sort of because the design was nice, but not much else worked. Then it was gone.”

After the site was compromised, its owners contacted the support team at Domains.co.za for answers. Diamond mentioned that the cause was quickly identified.

He explained that the AI tool had left the administrative password in the site’s code in plain text, making it easy for anyone to access the password via developer tools.

“No sophisticated attack. No zero-day exploit. The attackers just read the password and walked in through the front door,” stated Diamond.

“Hackers don’t need to be clever. They know exactly which mistakes AI tools make, and they run automated scans for them around the clock.”

Ian Jansen van Rensburg, security engineering head for Africa at Check Point Software, indicated earlier this year that criminals specifically target sites built with Claude or Google’s Gemini.

These AI-driven threat actors can reveal the code behind these websites, providing criminals with avenues to exploit company systems.

“All of a sudden, there is an external-facing application, and hackers understand that code because their AI picked it up,” Jansen van Rensburg explained.

“Hackers are using AI, and their attacks are now at the speed of a machine and not a human. These things get exploited very quickly.”

Diamond emphasized that cybercriminals can identify AI-generated vulnerabilities in websites within hours of those sites being launched.