AI-written code lacked recharge callback verification, letting a user forge $10K+ in credits
gefei55 · x · 2026-10-26
A developer shares a live incident: AI-generated payment code missed recharge callback verification, letting a newly registered user forge callbacks to add credits — 23 orders and over $10,000 in suspicious recharges overnight. The fix, ironically, was also delegated to AI. Lesson: manually audit verification/signature logic in any AI-written payment flow.
More from coding & agent
- OpenClaw ships v2026.10.7 with 61 PRs from 54 contributors — heyneighbor · 2026-10-26
- TokenSpeed's Three-Language Stack: C++ for Correctness, Rust for Agents, Python for Glue — zhyncs42 · 2026-10-26
- IBM's open-source MCP gateway ContextForge unifies MCP, A2A and REST APIs behind one endpoint — tristanbob · 2026-10-26
- RAG Reranker Showdown: Small Cross-Encoder Pushed Correct Chunks Out of Top 5 — Affectionate_Slip654 · 2026-10-26
- 10 open-source GitHub repos that give your AI agent a chat UI, by stars — victor_explore · 2026-10-26
- SirenoRELAY: a policy-boundary MCP that lets AI agents read only allowed mail and send only to allowed recipients — ismaelfaro · 2026-10-26