Medical System Developed with “Vibes” Unleashes Personal Data… The Terrifying Vibe Coding Incident of 2026

📰 News Overview

• Healthcare professionals started using AI agents to create and operate their own custom patient management systems.
• An investigation revealed that all patient data was left completely exposed on the internet without encryption.
• Voice recordings from consultations were automatically sent to multiple external AI services for summarization without patient consent.

💡 Key Points

• The application turned out to be a single HTML file (with inline JS/CSS), with authentication logic residing solely on the client side.
• There were no access controls or row-level security (RLS) set up for the backend database.
• The storage of data on US servers and the absence of a Data Processing Agreement (DPA) crossed significant legal and ethical boundaries.

🦈 Shark’s Eye (Curator’s Perspective)

Anyone can get an AI agent to whip up something that “looks right,” but the real horror of “Vibe Coding” lies in its hollow foundation! In this case, the authentication logic was merely written in JavaScript on the client side, a fatal flaw reminiscent of a time warp back to the 20th century. With no access controls on the backend DB, a single curl command could extract all data… it’s like a digital version of a “vault with no lock.” Handling sensitive medical data based solely on vibes of “if it runs, it’s fine” is a serious crime. This incident underscores that while AI can write code, it won’t take responsibility for secure architecture!

🚀 What’s Next?

As we enter an era where “anyone can be a developer,” the automation of security audits and governance of AI-generated code will become crucial. “Vibe development” without legal knowledge or foundational infrastructure poses an increasing risk of severe legal and social repercussions.

💬 A Word from Haru-Same

Swimming just on vibes is dangerous! Make sure to understand the “structure” and swim safely in the sea! 🦈🌊

📚 Terminology

• Vibe Coding: A method of building software based on instructions to AI and “vibes” without understanding technical details or architecture.

• nDSG: Switzerland’s new federal data protection law aimed at strengthening personal privacy protections through strict regulations.

• Row-Level Security (RLS): A security feature in databases that limits data rows accessible to users, preventing unauthorized data retrieval.

• Source: An AI Vibe Coding Horror Story