The Best (Or Worst?) Vibe Coding Blunders - Part 3

Vibe coding blunders are more common than you’d think.

We started researching a couple weeks ago and found hundreds of worth-sharing incidents. To keep things digestible (and spare you a ten-part series), we shortlisted the thirty best and split them across three posts.

This is the last one. Parts 1 and 2 are there if you need to catch up.

On to the final ten.

1. Gemini’s CLI read a chat message as a command and deleted the project

A developer was using Google’s Gemini CLI, a popular agentic coding tool, to work on a project.

During the conversation, the tool misinterpreted an ordinary line of text as a command and executed it.

That command deleted the developer’s entire project directory.

Source: GitHub

2. Copilot invented an entire codebase and swore it was real

A developer asked GitHub Copilot Chat about a non-existent project, and Copilot answered in confident detail: classes, methods, the contents of specific files.

Copilot had invented the entire codebase, describing software that did not exist as though it were reading directly from the project files.

When the developer pushed back and said these things weren’t in the project, Copilot didn’t waver. It insisted they were there.

Source: GitHub

3. An app leaked 600,000 users’ most private data, after months of warnings

Quittr, an app built to help people quit porn, grew fast, with reports of roughly a million dollars in revenue within days of launch.

Its Firebase database was still in test mode, a development setting that left the data accessible to anyone who knew where to find it.

The detail that turns this from a mistake into a blunder: hackers had been warning the company about the hole for months. The warnings went unanswered while the data stayed exposed.

Source: 404 Media

4. Cursor’s support bot invented a policy, and users quit over it

Cursor users started getting logged out whenever they switched between devices. Reasonable thing to ask support about: is this a bug?

The support agent, an AI named Sam, told them it wasn’t.

"Cursor is designed to work with one device per subscription as a core security feature."

No such policy existed. Sam had made it up.

But it sounded official, it arrived through the company’s own support channel, and people believed it. Some cancelled their subscriptions before Cursor co-founder Michael Truell showed up to clean up the mess: “We have no such policy. You’re of course free to use Cursor on multiple machines. Unfortunately, this is an incorrect response from a front-line AI support bot.”

This is the same failure as a hallucinated package or an invented function, pointed at a customer instead of a codebase. The bot didn’t know the policy. It generated a plausible one and delivered it as fact.

Source: Slashdot

5. Claude Code destroyed a day’s edits just to peek at another branch

The goal was harmless: look at what was on a different branch.

To do it, Claude Code ran git checkout origin/some-branch -- ..

That command doesn’t show you the other branch. It overwrites your working files with that branch’s version of them.

Fourteen files of unstaged, uncommitted work were replaced in place. Because the changes had never been committed, git had no copy of them to bring back. They were simply gone.

This is the same failure as the git reset story from Part 1: the agent reaches for the command that satisfies the literal goal without checking what it overwrites on the way there.

Source: GitHub

6. A folder named ~ tricked Claude Code into deleting the home directory

The agent created a directory named ~. A single tilde.

That’s a trap, because ~ isn’t an ordinary name to the shell. It’s shorthand for your home directory.

So when the agent later ran a cleanup that referred to ~, the shell didn’t touch the folder called ~. It expanded the tilde and went straight for the real home directory.

rm -rf did the rest.

We saw a relative of this in Part 2, where a tilde that failed to expand sent a delete to the top of the filesystem. Same character, opposite mistake, same casualty: the user’s home directory.

Source: GitHub

7. The task was done. Claude Code kept billing for it anyway

Sometimes the failure isn’t destruction. It’s a tool that doesn’t know when to stop.

A developer watched Claude Code finish a task and then, instead of ending, slip back into a working state again and again. The status line cycled through the same word more than fifty times.

Nothing was being produced. The work was already finished. But the token counter kept climbing with every empty pass.

It had done the job. It just couldn’t tell that it had.

Source: GitHub

8. AWS’s own AI coding agent deleted a live environment. AWS said it wasn’t the AI’s fault

Amazon builds an agentic coding tool called Kiro, and its own engineers use it internally.

In December 2025, engineers let Kiro handle what was meant to be a small fix to AWS Cost Explorer, the dashboard customers use to track their cloud spend.

Kiro, in its wisdom, decided the cleaner path was to delete the environment and rebuild it from scratch.

Nobody reviewed the plan before it ran.

When the Financial Times reported the outage, Amazon pushed back on the idea that the AI was responsible:

“The brief service interruption was the result of user error — specifically misconfigured access controls — not AI.”

A staffer had granted Kiro broader permissions than intended. The agent simply used all of them.

Blame the human who set the permissions, blame the agent that used them, or blame both. Either way, the dashboard was down for 13 hours.

Source: Engadget

9. A malicious npm update turned Claude Code, Gemini CLI, and Amazon Q into secret-stealing tools

In August 2025, attackers slipped a malicious script into several versions of Nx, a widely used build tool. For roughly five hours, anyone who installed one of those versions also ran the hidden script.

The script launched the AI tools with all their safety controls disabled.

On machines with Claude Code, Gemini CLI, or Amazon Q installed, the script searched for sensitive data such as GitHub tokens, SSH keys, .env files, and crypto wallet information. It then uploaded the stolen data to a public GitHub repository through the victim’s account.

npm removed the affected versions quickly, but more than 2,300 credentials had already been exposed.

Source: Snyk

10. A researcher took over a BBC reporter’s laptop through a vibe-coding platform, with zero clicks

BBC technology reporter Joe Tidy downloaded Orchids, a vibe-coding platform used by roughly one million people, and began building a game based on the BBC News website.

Around the same time, security researcher Etizaz Mohsin discovered a vulnerability that allowed code generated by Orchids to run on a user’s computer without clear limits on what it could do.

Mohsin used the flaw to reach into Tidy’s laptop with no click, no download, no permission prompt. He changed the wallpaper and planted a file, gently, just to prove it could be done.

He’d sent the company twelve warnings over several weeks before going public. Eventually, Orchids responded that his messages “may have been overlooked among many others.”

Source: InformationWeek

Where all three parts land

Three posts, thirty stories. Databases deleted, keys leaked, bills run up overnight, packages hallucinated, codebases invented, home directories erased.

There is a common thread running through all of them: vibe coding tools can produce output that looks convincing whether it is right or not. They cannot reliably tell you when they are guessing, and the result does not always make that obvious.

That is not a reason to stop using them. It is a reason to build oversight into the process, especially when real users and/or sensitive data is involved.

That’s exactly the gap we fill. book a free consultation today and we’ll help you find the risks, fix the weak points, and make sure your product is ready to ship.