South African AI-built website hacked after six days when admin password was exposed

A South African website built using an AI coding tool was reportedly compromised six days after going live because its administrator password was left in code visible to visitors.

The account comes from Wayne Diamond, chief executive of hosting provider Domains.co.za, as reported by MyBroadband on 18 October. The affected customer and the specific AI tool were not publicly identified in that report, limiting independent verification of the incident.

Diamond said the client had chosen to build the site with an AI tool rather than the hosting company’s own website builder. The resulting site appeared visually acceptable, but an administrative credential had been exposed in its source. Someone who inspected the page code could obtain that password.

The failure was basic access control

This was not described as an attack requiring a previously unknown software flaw. The reported weakness was a secret placed where a visitor could read it.

Developers sometimes embed credentials in code while building or testing an application. If those values are shipped into browser-delivered JavaScript or public HTML, they are no longer secrets. Obscuring a password in a bundle does not make it private.

The lesson is not that every AI-assisted website is insecure. Human-written applications can expose secrets too. The operational failure is deploying an internet-facing system without checking what it reveals, how administrators authenticate and whether credentials are stored and used on the server side.

A proper release check should include searching built assets for credentials, removing exposed secrets, rotating any password that has already been published and limiting administrator access. Testing must cover the deployed site, not only the source code developers believe they wrote.

Why South African businesses should care

Small companies, agencies and independent founders increasingly have access to tools that can produce functioning websites quickly. That shortens the distance between a prototype and a public service, but it does not remove the need for security review.

If an administrative account is compromised, the consequences can extend beyond a defaced page to customer records, business email integrations or payment workflows, depending on what the account can access. There is no verified public evidence in this case that those additional systems were affected.

The customer’s identity, the AI product involved, the attacker’s identity and the full scope of the breach remain unconfirmed. What is clear from the provider’s account is that a visible administrator password was sufficient to defeat the site’s security within its first week.