6.8% of 1,049 AI-Built Apps Found Leaking Private Data Due to Disabled Security Setting

·2 views

A security researcher scanned 1,049 publicly listed AI-built applications in 2026 and found that 71 of them, roughly 6.8%, had at least one database table containing real private data accessible without any login. The vulnerability stemmed from a known misconfiguration: Row Level Security left disabled on Supabase-backed apps that expose a public API key in the browser's JavaScript. Exposed data included account profiles, private messages, paid usage history, and in one case a master database key granting full read, write, and delete access. The researcher manually reviewed results to exclude 40 apps with intentionally public tables, such as leaderboards and blog posts, before notifying all 71 affected companies individually with details of the exposure and a free offer to help fix it. The findings align with earlier reports from Wiz, Forbes, and The Verge, which have consistently placed the misconfiguration rate among AI-built apps at between one in ten and one in fifteen.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

n8n Integrates Amazon Bedrock AgentCore for Managed AI Agent Workflows

n8n has spotlighted a verified community node that connects Amazon Bedrock AgentCore with its workflow automation platform. The integration, built by AWS, allows users to run production-grade AI agents within a managed runtime provisioned directly in their own AWS account. A demo support-triage workflow showcases four specialist agents sharing a common memory harness, enabling context to persist across turns and between agents without restarting each interaction. The node supports multiple AI model providers, isolated execution environments, and cloud tools such as a code interpreter and browser. It is compatible with both self-hosted and cloud versions of n8n, though AWS account setup including IAM configuration is required.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Microsoft Entra lets organizations delegate AI agent consent without broad admin roles

Microsoft Entra supports a granular consent delegation model that moves beyond the traditional binary choice of full centralization or broad administrative roles. Organizations can define app consent policies specifying exact permission types, resources, and client applications, then bind those policies to custom directory roles. The key role action, microsoft.directory/servicePrincipals/managePermissionGrantsForAll.{id}, restricts a delegate's consent authority strictly to what the policy allows, rather than granting wide directory access. This approach is increasingly relevant as AI agents multiply, turning tenant-wide consent from an occasional setup task into a recurring control-plane operation. Using broad built-in roles like Application Administrator to clear consent queues expands authority without improving precision, whereas policy-bound delegation addresses both scale and control simultaneously.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Satirical Essay Mocks AI-Reliant Developers Who Never Read Their Own Code

A satirical piece published on DEV Community lampoons the growing trend of developers relying entirely on AI agents to write, review, and document code. The essay coins the term 'Real Programmers' for those who orchestrate AI tools using plain English prompts, contrasting them with 'Quiche Eaters' who still read and write code manually. It mocks practices like skipping permissions flags, approving pull requests in seconds, and regenerating code instead of debugging it. The piece also takes aim at self-referential AI workflows where agents both write and document code, eliminating human comprehension from the loop. While framed as humor, the essay reflects genuine industry debate over how much understanding developers should retain as AI-assisted coding becomes mainstream.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Qwen 27B on Q3 Quantization Generates WebGL Human Head Without Libraries

A user tasked the locally-run Qwen 27B language model, quantized at Q3_K_M, with generating a 3D human head in WebGL from scratch using no external libraries. The model produced a complete WebGL scene running on just two consumer-grade RTX 3060 Ti GPUs, requiring no datacenter hardware. The result was described by the community as eerily humorous, yet technically impressive given the model's size and memory constraints. Q3 quantization significantly reduces memory usage, enabling a 27B-parameter model to run on standard gaming GPUs that could not handle the full-precision version. Notably, community members observed that this smaller, quantized model outperformed the larger Qwen3.5 122B-A10B on the same task, highlighting meaningful progress in local AI code generation.

0 comments Read more at DEV Community