AI-Built Website Hacked Six Days After Launch, Highlighting ‘Vibe Coding’ Risks in South Africa

A South African business had its new website hacked just six days after launch because the AI tool used to build it left the admin password exposed in the site’s code, according to Domains.co.za CEO Wayne Diamond.

Diamond described the incident in a LinkedIn post. The client had chosen not to use Domains.co.za’s website builder and instead built the site with a popular, free AI tool. He said the site looked good but much of it didn’t work, and then it was gone.

When the owners asked Domains.co.za’s support team what had happened, the cause was quickly found. The AI tool had left the admin password in plain text in the site’s code. Anyone could read it by inspecting the code with a browser’s developer tools. No human had checked the code before the site went live.

“No sophisticated attack. No zero-day exploit. The attackers just read the password and walked in through the front door,” Diamond said. He added that attackers know which mistakes AI tools make and run automated scans for them around the clock. He said AI-generated vulnerabilities can now be found within hours of a site going live.

The incident comes as AI use grows quickly in South Africa. Microsoft’s latest AI Diffusion report, as reported by AI Impact, ranks South Africa 46th of 147 economies for generative AI usage as of March 2026, the highest in Africa. Ravi Bhat, commercial solutions and AI officer at Microsoft South Africa, said local AI usage had risen to more than 23%.

According to the same report, South Africa has more than 500,000 developers, alongside Egypt and Nigeria, and AI use among developers is growing. Many now rely on accessible tools such as Anthropic’s Claude Code to speed up coding and fix bugs.

Rennie Naidoo, research director at Wits Business School, said delivery pressure and a shortage of senior developers make AI coding assistants seem like the perfect solution. But he warned that “speed is seducing us into complacency.”

Writing for CIO South Africa, Naidoo described “vibe coding” as the growing habit of accepting AI-generated code with little scrutiny. He compared it to flying on autopilot without checking the instruments: it works until it doesn’t. He said research from Veracode and several academic studies shows that nearly half of AI-generated code contains known vulnerabilities.

Ian Jansen van Rensburg, head of security engineering for Africa at Check Point Software, said earlier this year that criminals specifically target sites built with Claude or Google’s Gemini. He said attackers’ own AI tools can read and understand the code behind these sites, turning newly exposed applications into entry points.

“Hackers are using AI, and their attacks are now at the speed of a machine and not a human,” he said. “These things get exploited very quickly.”