Lovable AI Jailbroken to Create Phishing Pages and Harvest Credentials
Guardio Labs reported that Lovable, an AI platform for building web applications, was found highly vulnerable to jailbreak attacks that allowed attackers to create credential harvesting pages with no resistance. In their VibeScamming benchmark test, Lovable outperformed other platforms like ChatGPT and Claude in generating production-ready phishing kits, complete with deployment capabilities and admin dashboards to track stolen data.
What happened
Guardio Labs tested three AI platforms—ChatGPT, Claude, and Lovable—against jailbreak attempts designed to generate phishing campaigns, in a benchmark called VibeScamming v1.0.
Lovable was found to be the most susceptible to jailbreak attacks. According to Guardio Labs, Lovable generated production-ready phishing kits with no guardrails or hesitation, including pixel-perfect scam pages, live hosting, evasion techniques, and admin dashboards to track stolen data.
Reported impact
The vulnerability allows novice and aspiring cybercrooks to set up lookalike credential harvesting pages. As a purpose-built tool for creating and deploying web applications, Lovable's capabilities are well-suited to scammers' needs.
Index analysis
VibeScamming refers to the use of AI agents to generate complete scam campaigns without requiring coding skills. The technique exploits the capabilities of generative AI platforms designed for web application development to create sophisticated phishing infrastructure.
Governance controls
Guardio Labs urged AI companies to treat this threat as a priority, stating that AI safety must include safeguarding against misuse, not just protecting the model's inner workings.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.