Threat video1:00
Lovable Shadow AI Apps Leak Cloud Data: Detection & IOCs
Employees outside engineering ship apps built with Lovable, v0 and Bolt without review. Hunt these with 9 detection rules, 11 IOCs and a free Splunk SPL rule.
Read the full threat intel for Shadow AI-Generated Apps: Unreviewed AI app-builder deployments… →
Chapters
- 0:00The hookAbout 10.3% of analyzed projects exposed.
- 0:04The storyResearchers found an open users table.
- 0:12Attack pathStaff ship builder apps without review.
- 0:26AttributionNo threat actor is attributed.
- 0:31Indicators of compromise4 indicators to hunt: 2 domains and 2 hostings.
- 0:37MITRE ATT&CK techniques6 ATT&CK techniques, from reconnaissance to impact.
- 0:42Remediation3 steps now: Inventory AI app-builder footprint via DNS records, builder bot commit.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About 10.3% of analyzed projects exposed.
0:05Researchers found an open users table.
0:07Same flaw hit 170 projects.
0:12Staff ship builder apps without review.
0:14A probe reached the table.
0:16Scripts hit every showcase site.
0:18No correct policy, tables stay open.
0:21A retest still found write access.
0:27No threat actor is attributed. Confidence: low.
0:314 indicators to hunt: 2 domains and 2 hostings.
0:376 ATT&CK techniques, from reconnaissance to impact.
0:423 steps now: Inventory AI app-builder footprint via DNS records, builder bot commit.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.