Unnamed free AI website builder exposed admin password, letting attackers hack a South African business site six days after launch
A South African business built its new website with a popular, free AI tool. According to Domains.co.za CEO Wayne Diamond, the tool left the admin password in plain text in the site's code, readable through a browser's developer tools. No human checked the code before launch, and attackers used the password to hack the site six days after it went live. Diamond said attackers run automated scans for the mistakes AI tools make.
What the AI did
A popular, free AI website-building tool, which has not been named, generated the business's new website and, according to Domains.co.za CEO Wayne Diamond, left the admin password in plain text in the site's code. Anyone could read it using a web browser's built-in developer tools.
First reported October 18, 2026 · Added to the register October 30, 2026 · 1 source
- Affected
- A South African business
- Country
- South Africa
- When it happened
- Not stated in the sources
- First reported
- October 18, 2026
What this means for you
Could this affect you?
If you build websites or apps with AI tools. Businesses that publish websites or apps built with AI coding or website-building tools without a person reviewing the code are exposed, because attackers reportedly know the mistakes such tools make and run automated scans for them around the clock.
What to check
- Have a qualified person review AI-generated code before it goes live.
- Scan your code for hard-coded passwords and other secrets before launch.
- Never put admin passwords in the part of a website's code that visitors' browsers can see.
Areas of your AI programme this touches
Every fact and its source (5)
- Time to compromiseHacked six days after launch“had its new website hacked just six days after launch”[1]
- AI tool usedA popular, free AI tool (unnamed)“built the site with a popular, free AI tool”[1]
- Root causeAdmin password left in plain text in site code“The AI tool had left the admin password in plain text”[1]
- Process failureNo human code review before launch“No human had checked the code before the site went live.”[1]
- SourceDomains.co.za CEO Wayne Diamond, via LinkedIn post“according to Domains.co.za CEO Wayne Diamond”[1]
Sources
- AI-Built Website Hacked Six Days After Launch, Highlighting 'Vibe Coding' Risks in South Africaiafrica.com · October 18, 2026
How this record is classified. Severity S (3/5): real harm to one organisation, data exposed, or a containment failure. OECD level: incident, an event in which an AI system led to actual harm. Evidence: Reported, meaning press reporting only.
The facts in At a glance and in Every fact and its source are quoted from the sources listed. The summary, What the AI did and What this means for you are written from those sources and checked against them automatically before publication. Records reflect what has been disclosed, not everything that has happened. Incidents are found through news feeds and the GDELT Project.
