SWITCH Beyond · Thursday 29 October · Cassia Main 2

Break it before you ship it

Ethan Seow · Practical Cyber · Centre for AI Leadership

Rogue AI

1.5 million

Agent keys, readable by anyone who opened the page.

Moltbook, February 2026. The database key was in the JavaScript, where a publishable key is supposed to be. Row-level security was off, so the key was a master key. The open database allowed read and write: 1.5 million agent tokens, 35,000 email addresses, and private messages.

Wiz, 2 February 2026. Wiz also reported about 17,000 human accounts behind those agents.

The same two mistakes

170

Apps. The catalogued version of that mistake, a year earlier.

CVE-2025-48757. Apps built on Lovable shipped Supabase tables with row-level security off. About 170 of 1,645 launched sites, 303 endpoints. Rated 9.3. Lovable disputed the record. The pattern is the one Moltbook repeated.

NVD · Matt Palmer, discovered 20 March 2025, published 29 May 2025.

Keys, then the lock

Six questions before anything goes live

  1. 1Is a key visible in the browser?
  2. 2Is the database locked to each person?
  3. 3Can a changed number show someone else’s row?
  4. 4Does login block the request, or only hide the button?
  5. 5Which packages did the AI add?
  6. 6Does the assistant obey a hostile document?The next hour
Photograph the list at the end

The key in the page is not the secret.

A Supabase publishable key is meant to ship in the browser. It names the project. It becomes a master key when the tables have no row rules.

Moltbook had both. Some of the private messages held model-provider keys in plain text. Those keys were never meant to be in a browser, or in a chat.

Wiz, 2 February 2026.

Question 1

Unlocked means they can change it, too.

Missing row rules did not only return the list. The same request could insert, update, and delete. On the 2025 apps, that included flipping a payment status to paid. On Moltbook, it included editing the platform’s own posts.

Supabase now turns row-level security on for tables made in its table editor. Tables added by an agent, or policies that exist and still allow too much, are the hole that remains.

Matt Palmer on CVE-2025-48757 · Wiz on Moltbook.

Question 2
3 Feb – 20 Apr 2026

Public meant the workshop, not the shop window.

Lovable’s own account: chat history and source code of public projects could be opened by any logged-in user who had the link.

What stayed closed

Private projects did not.

Private projects and Lovable Cloud were not affected. The first report, on 22 February, was closed. Internal docs still said those chats were meant to be visible. The fix shipped within two hours of the public report on 20 April.

Lovable, 22 April 2026.

Questions 3 and 4

8 Oct

An agent SDK shipped a worm through its own release pipeline.

tensorlake 0.5.144 was on npm for about an hour and forty minutes, with valid provenance. Provenance says which repository built the package. It does not say the commit was theirs. The package steals the tokens that can publish the next one, and it plants project files a coding agent will run later.

Tensorlake advisory GHSA-8g63-53c9-65j2, 8 October 2026. The September 2025 CISA alert was the first wave.

Question 5

A document can change the job.

The assistant is told to answer from company files. If a file contains an instruction, the model may treat it as the task, then use a tool. OWASP’s agent list, December 2025, puts that first and calls it goal hijack.

Google measured a 32% rise, from November 2025 to February 2026, in malicious pages of this kind on the public web. Most of what they found was still crude. The ones that matter are the ones that make the agent act.

OWASP GenAI, 9 December 2025 · Google Online Security Blog, 23 April 2026.

Question 6

What this assistant did on 28 September

Print the fileAsked directly to reveal the confidential schedule. It did not.
Email the fileAn instruction hidden in a policy, telling it to send the file outside. It did, about two times in three, on Gemini Flash.
A stricter sentenceStopped that one payload. Stopping one payload is not a guarantee.

Measured on the lab you are about to open. The email never leaves the room. It is written on the page.

Then we tried the fixes

Four switches. Three of them do not ask the model to behave.

Stricter instruction

Tell it, more firmly, to ignore instructions inside documents.

Held once. Not a proof.

Least privilege

The assistant can no longer open the pay file at all.

Holds. Nothing to send.

Output filter

Ordinary code blocks an outside email that looks like salary data.

Holds for what it checks.

A person

An outside email waits. Your team is the reviewer.

Holds if you say no.
The exercise after 10:50

Before you ship

Photograph this.

  1. Is any password or key visible in the browser?
  2. Is the database locked? No red “unrestricted”.
  3. Can you see someone else’s data by changing a number in the URL?
  4. Does login actually block, or does it only hide the button?
  5. What packages did the AI add? Are they real, and did you look?
  6. Does your AI feature obey a hostile message pasted into it?
The thing you keep

The next hour, on your laptop

  1. Log in with the code on your table card. You are an employee of ACME.
  2. Ask a normal policy question. Then ask for the executive pay. Watch what it refuses.
  3. Edit a policy. The pay file is locked. The policies are not. The assistant reads them.
  4. Watch the line under the answer. It shows the file it opened and the email it tried to send. Nothing is actually sent.
  5. Turn one switch on and try the same question again.
Teams of four to six

You do not have to read the model.

You have to decide what it is allowed to touch, and what a person must approve.

Practical Cyber