Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-03-17 · source-backed
Hacktron AI's audit of Cloudflare's AI-generated Vinext framework is the first enterprise-scale proof of what everyone feared about vibe-coded production infrastructure. 45 vulnerabilities identified, 24 manually validated, 4 critical: race conditions enabling cross-request state pollution, cache poisoning that serves private user data to all subsequent visitors, and a middleware bypass exposing admin panels to unauthenticated requests. Vercel's Guillermo Rauch separately disclosed 7 confirmed vulnerabilities through responsible disclosure.
Cloudflare built Vinext in roughly one week using Claude Code with "human oversight limited to architecture and design decisions, not line-by-line code review." That last phrase is the entire lesson. Architecture review without code review is not review — it's a rubber stamp on a system where the security-critical details live in implementation, not design.
The specific vulnerability classes are instructive. Cache poisoning means a single malicious request can compromise the response served to every subsequent user for the cache TTL duration. Cross-request state pollution means user A's session data leaks into user B's context. Middleware bypass means the auth layer — the one thing you'd think gets human review — was silently circumventable.
This isn't about Claude Code being bad at security. It's about the workflow. When Hacktron ran the same codebase through generic Claude Code security prompts, it found 24 findings with 1 of direct impact. AISafe's purpose-built tooling found 20 findings with 9 of direct impact and zero false positives. Generic "please audit this" prompts reliably miss business-logic flaws. The lesson: if you're vibe-coding production infrastructure, the security review cannot also be vibe-coded. Source
Each link below shares sources, entities, or timing with this story.
Claude Code benchmarked against AISafe / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Claude Code benchmarked against AISafe); both cover Claude Code, Vercel, Vibe; overlapping topics (claude, code, vulnerability).
Linked by a graph relationship (Claude Code benchmarked against AISafe); both cover Claude Code, Cloudflare, Vercel; overlapping topics (claude, code).
Claude Code benchmarked against AISafe / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code benchmarked against AISafe); both cover Cache, Claude Code, Cross; overlapping topics (claude, code).
Claude Code benchmarked against AISafe / Shared entities / Shared topic / What happened next / Tension
Linked by a graph relationship (Claude Code benchmarked against AISafe); both cover Claude Code, Vercel; overlapping topics (claude, code).
Claude Code benchmarked against AISafe / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Claude Code benchmarked against AISafe); both cover Claude Code, TTL; overlapping topics (cache, claude, code).
Linked by a graph relationship (Claude Code benchmarked against AISafe); both cover Claude Code, TTL; overlapping topics (cache, claude, code).
Linked by a graph relationship (Claude Code benchmarked against AISafe); both cover Claude Code, Cloudflare; overlapping topics (claude, cloudflare, code).
Linked by a graph relationship (Claude Code benchmarked against AISafe); both cover Claude Code, TTL; overlapping topics (cache, claude, code).