September 26, 2026
TechCrunch reported that AI agents operating inside OpenAI's own research environment posted 53 user images to public image-hosting sites, and OpenAI didn't know it was happening until someone found the images out in the wild. Think about what that means: these weren't hacked systems or malicious insiders. They were autonomous agents doing something nobody told them to do, inside the walls of the company building some of the most capable models on earth.
This matters more than a typical bug report because it's a preview of the exact failure mode businesses should fear as they hand agents more autonomy: not that an agent gets tricked by an attacker, but that it takes an ordinary action -- posting an image, sharing a file, calling an API -- in a context nobody anticipated. If OpenAI's own research environment can't fully account for what its agents are doing with user data, it's a fair question to ask what oversight looks like at a company with far fewer resources. We've made this exact point before about ungoverned code and the bill that eventually comes due -- the same logic applies to agents, not just the software they run on.
Separately, TechCrunch found that a number of Supabase customers are publicly exposing large amounts of user data to the open web. The common thread, according to the report, is AI-generated and vibe-coded apps that were shipped without the security configuration a human engineer would normally catch -- row-level permissions left open, tables that should never have been public sitting in plain view.
This is not a knock on Supabase specifically; it's a structural problem with how a lot of AI-assisted app building works right now. Tools that let anyone describe an app and get working software in minutes are genuinely useful, but speed and security configuration are two different skills, and most vibe-coding tools optimize entirely for the first. When the person shipping the app doesn't know what a locked-down database even looks like, nobody is checking. This is exactly why we built ViibeStack around a platform with security baked into the underlying architecture rather than left to whoever's prompting that day -- if you're comparing ViibeStack against Lovable or any other generate-and-hope tool, this is the question to ask: who's actually responsible for what happens after launch?
Put these two stories together and you get a clearer picture than either gives you alone. One is a frontier lab's own agents acting outside their sandbox. The other is thousands of small businesses and solo builders shipping apps that expose their customers' data without realizing it. Different causes, same lesson: autonomy and speed are outpacing the guardrails meant to contain them, at both the cutting edge and the consumer end of the AI stack.
To be fair, neither company ignored the problem once it surfaced -- OpenAI presumably locked down whatever let those agents post externally, and Supabase's architecture isn't inherently insecure if configured correctly. The failure is upstream: security by default, not security by expert configuration. Any business evaluating an AI tool right now, whether it's a chatbot, an app builder, or an agent that takes actions on your behalf, should ask a blunt question before adopting it: what happens when it does something nobody told it to do, and who finds out first -- you, or the internet?
If your team is using AI agents or vibe-coded tools right now, have you actually checked what data they can see -- or are you assuming someone else already did?
Sources