Jailbroken Lovable AI Allegedly Used to Generate and Host Phishing Pages, Steal Credentials, and Bypass Security

April 9, 2025

The generative AI platform Lovable, designed for building web applications, was allegedly compromised and used maliciously to create full-scale phishing campaigns. These campaigns reportedly involved credential-stealing login pages, evasion techniques, real-time data exfiltration via services like Telegram and Firebase, and deployment of the phishing content on a URL hosted under its own subdomain.

Contributing to the importance of trustworthy AI, this incident underscores the need for robust governance mechanisms. For those interested in shaping responsible AI practices, JOIN US and explore how you can contribute to the HISPI Project Cerebellum TAIM (Govern) efforts.

Matched TAIM controls

Suggested mapping from embedding similarity (not a formal assessment). Browse all TAIM controls

MAP 1.6 — similarity 0.652, rank 1. TAIM detail and related incidents →
MEASURE 2.10 — similarity 0.649, rank 2. TAIM detail and related incidents →
GOVERN 1.2 — similarity 0.644, rank 3. TAIM detail and related incidents →

Alleged deployer: unknown-actors, cyber-criminals, cyber-criminal-networks
Alleged developer: loveable-ai
Alleged harmed parties: general-public, users-targeted-by-phishing-attacks, impersonated-organizations, microsoft

Source

Data from the AI Incident Database (AIID). Cite this incident: https://incidentdatabase.ai/cite/1016

Data source

Incident data is from the AI Incident Database (AIID).

When citing the database as a whole, please use:

McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. In Proceedings of the Thirty-Third Annual Conference on Innovative Applications of Artificial Intelligence (IAAI-21). Virtual Conference.

Pre-print on arXiv · Database snapshots & citation guide

We use weekly snapshots of the AIID for stable reference. For the official suggested citation of a specific incident, use the “Cite this incident” link on each incident page.