Your AI App Ships Fast. The Security Bill Arrives Later.

A founder ships a data platform over a weekend using an AI assistant. Three months later, the AWS bill arrives: $31,000. He generated none of that traffic. An attacker found his AWS access key — committed to a public repository by the AI that built his app — and spun up GPU instances for cryptocurrency mining. The key was rotated. The bill stayed.

This is a composite scenario. The mechanism is not. In 2025, GitGuardian documented 28.65 million hardcoded credentials in public GitHub commits — a 34% year-over-year increase, the largest single-year jump ever recorded.^[1] AI-assisted commits expose secrets at 2.74 times the rate of human-only commits.

The Problem Is Not AI

AI coding assistants are fast and genuinely useful. They are not the problem.

The problem is scope. An AI assistant produces exactly what you ask for — and nothing more. Ask for a working app, you get one. Never ask whether your S3 bucket should be publicly listable, and the model will not tell you. Security is not missing from these apps by accident. It was never requested.

A 2026 scan of 198 iOS AI-built apps found 196 actively exposing user data through misconfigured cloud backends — a 98.9% failure rate.^[2] Not because AI wrote bad code. Because the builders never asked for secure defaults.

Three Vulnerabilities Behind Most Incidents

Security researchers scanning close to 5,600 AI-built applications in early 2026 discovered over 2,000 vulnerabilities and more than 400 exposed secrets.^[3] The same three failure modes appear across almost every case.

1. Overpermissioned cloud storage

When AI scaffolds cloud storage, it commonly grants s3:ListBucket alongside s3:GetObject. Both work — but GetObject downloads a specific file, while ListBucket lets anyone enumerate every object in the bucket: every uploaded document, every invoice, every internal asset. Sixty percent of developers fail to adjust these scopes before shipping.^[4]

The fix is one line in an IAM policy. The exposure, if missed, is everything your users have ever stored.

2. Hardcoded credentials

AI models reuse patterns. In one analysis of 20,000 AI-generated applications, the string supersecretkey appeared in 1,182 of them.^[5] More dangerous are real credentials: API keys, database passwords, and access tokens that a developer pastes into a prompt for context and the model reproduces in the output.

These credentials land in version control, sit in public repositories, and get scanned for continuously — driving a 34% year-over-year growth in exposed secrets.

3. Auth flows built for the happy path

AI produces auth code that works for the legitimate user logging in correctly. CSRF protections, rate limiting, token expiry, and session invalidation are not included unless explicitly asked for — and most founders never ask.

In February 2026, Moltbook — a social network built entirely through AI-assisted coding — was found with its Supabase database set to public read and write. The AI scaffolded permissive defaults; the founder shipped them as-is. Wiz discovered it in a routine scan.^[6]

What Actually Happens to Your Business

Most coverage of this topic stops at data exposure. The full liability is wider.

Cloud bill fraud. An attacker who finds your access key spins up GPU instances — $3–8 per hour on standard providers, no automatic cap. A key left unrotated for a week generates a bill you may not recover.

Ransomware. A misconfigured access control gives an attacker a foothold. From there, ransomware is deployed. The average breach costs an SMB $254,445;^[7] 60% close within six months.^[8] Double extortion — data exfiltrated before encryption — means backups alone do not protect you.

Regulatory liability. If your app exposes personal data through a misconfiguration, "the AI generated it" is not a legal defense. GDPR applies for European users; equivalent laws apply in most jurisdictions. Fines compound on top of remediation costs.

Botnet enlistment. Your EC2 instance can become a DDoS botnet node with no obvious symptoms — you notice only when AWS flags the traffic and suspends your account.

None of these outcomes require a sophisticated attacker. They require a scanner, a script, and a misconfigured app.

Four Things You Can Do Before You Read Another Word

These take under ten minutes and require no security background.

1. Run grep -r "AKIA" . from your project root. That prefix appears in every AWS access key. If it shows up anywhere outside a .env.example, you have a leaked key — rotate it immediately and assume it has already been found.
2. Open your S3 bucket policy and remove s3:ListBucket if it is there. GetObject alone is sufficient for serving files; ListBucket is what lets anyone enumerate everything your users have ever uploaded.
3. Confirm your backend is verifying the token signature on every protected request, not just decoding it. AI-generated auth flows often issue tokens correctly but skip verification on subsequent requests — find your auth middleware and confirm it calls the library's verify function, not decode.
4. Check that your backend enforces all token claims, not just the signature. Once signature verification is in place, confirm expiry, email verification status, account status, and role claims are also checked on every request — not just at login. A token for an unverified email or a suspended account should be rejected, not trusted.

If any of those checks surface a problem, stop and fix it before going further.

What a Pre-Launch Review Actually Is

A pre-launch security review is not a six-month audit. For an early-stage app, it is a focused two-to-four-hour assessment of cloud permission scopes, secrets management, authentication flows, and external endpoint exposure — with a prioritized list of what to fix before the first real user.

The cost is a rounding error against the average SMB breach cost of $254,445.

The best time to do it is before launch. The second-best time is now.

One question, if you built with AI assistance: did you ask the model to review your infrastructure for security, or only for functionality?

References

1. GitGuardian — State of Secrets Sprawl 2026
2. AI2Work — Vibe Coding's Security Reckoning: 380,000 Apps Expose Corporate Data
3. CSA Labs — Vibe Coding Security Crisis: Credential Sprawl and SDLC Debt
4. Apiiro — 4x Velocity, 10x Vulnerabilities: AI Coding Assistants Are Shipping More Risks
5. CSA Labs — AI-Generated Code Vulnerability Surge 2026
6. Barrack AI — Every AI App Data Breach Since January 2025
7. NinjaOne — 7 SMB Cybersecurity Statistics for 2026
8. spacelift.io — 60 Small Business Cybersecurity Statistics to Know in 2026