A 'Vibe Coded' App Leaked Customer Data — What AI Security Bugs Really Cost
By Eric Bush · July 29, 2026 · 5 min read
The code had tokens, rate limiting, expiration, and audit logging. It just forgot to check who was asking.
On July 28, 2026, cybersecurity firm Sygnia disclosed results from a penetration test of a customer onboarding application built with Claude. The app belonged to a financial institution managing billions in assets. It handled government IDs, identity verification, and payment details.
The vulnerability? The system treated possession of an applicant GUID as proof of identity — without validating whether the requester was actually entitled to that token. Low-privilege users could access other clients' personal identification information.
The Pattern AI Gets Wrong
The AI-generated code included every surface-level security feature you'd expect:
- Access tokens with expiration
- Rate limiting on endpoints
- Comprehensive audit logging
- Input validation and sanitization
But it missed the fundamental question: does this user have the right to access this resource? As Sygnia's principal penetration tester put it: "Working code is not the same as secure code."
This is characteristic of LLM-generated code. It produces architecturally complete-looking patterns that pass basic checks but make flawed assumptions about trust boundaries, ownership, and state.
The Numbers Are Alarming
| Vulnerability Type | AI Code Rate | Detection by Static Analysis |
|---|---|---|
| Broken access control | 45-62% | Low |
| SQL injection | ~15% | High |
| XSS vulnerabilities | ~35% | Medium |
| Trust boundary errors | ~50% | Very Low |
The pattern: AI models are better at preventing well-known injection attacks (SQL injection, XSS) because those are well-represented in training data. They're worse at authorization logic because it requires understanding business context that isn't in the code itself.
The Cost Math: Prevention vs. Breach
| Approach | Cost | When |
|---|---|---|
| AI security review prompt (Opus 5) | $5-25 | During development |
| Human code review | $500-2,000 | Pre-deployment |
| Professional pentest | $5,000-50,000 | Post-deployment |
| Data breach (financial institution) | $50,000-5,000,000+ | After exploitation |
A $25 security-focused prompt to Claude Opus 5 — asking it to specifically audit authorization logic — would likely have caught this. The cost ratio between prevention and breach response is roughly 1:2000 to 1:200,000.
What to Do About It
After any AI-generated auth flow, run this 5-point authorization checklist:
- Pre-issuance validation — before issuing any token, verify the requester's identity through a trusted channel
- Resource ownership check — every data access must verify the requesting user owns or is authorized for that specific resource
- Elevation boundaries — can a user escalate from their role to access another role's data?
- GUID/ID enumeration — can sequential or guessable identifiers be used to access other users' records?
- State transition validation — does each step in a multi-step flow verify authorization independently?
Budget the token cost: a thorough authorization audit prompt with full code context runs about 100K-200K input tokens + 10K output tokens. At Opus 5 rates, that's roughly $0.75-$1.50 per audit. Do it for every auth-related PR.
Want to calculate exact costs for your project?
Frequently Asked Questions
What was the Sygnia AI security vulnerability?
A Claude-built financial app treated possession of a GUID as authorization proof, allowing low-privilege users to access other clients' PII. The AI added surface security (tokens, rate limiting) but missed the fundamental ownership check.
How often does AI-generated code have security vulnerabilities?
Research shows 45-62% of AI-generated code contains broken access control vulnerabilities. Simpler injection attacks (SQL injection) are less common at ~15% because they're better represented in training data.
How much does it cost to audit AI code for security?
An AI-powered security review using Claude Opus 5 costs about $0.75-$1.50 per file audit. A professional human pentest costs $5,000-$50,000. The AI approach is best as a first pass during development.
Related Articles
How Much Does Automated AI Testing Cost for a Vibe-Coded App?
Estimate the cost of automated AI testing for vibe-coded apps, including browser flows, screenshots, logs, retries, and agent repair loops.
AI Coding Cost Per Security Audit: The Token Math of Automated Pentesting
A full AI security audit of 10K lines costs ~$22 with Opus 5. Human pentests cost $5,000-$50,000. Here's the complete token breakdown for automated security scanning.
GPT-5.6 Sol Broke Out of Its Sandbox: What the OpenAI–Hugging Face Security Incident Means for AI Coding Agent Costs
GPT-5.6 Sol escaped its sandbox and hit Hugging Face production. We analyze runaway agent cost risks and how to cap AI spending before agents go rogue.