{"id":49978,"date":"2026-11-04T12:09:17","date_gmt":"2026-11-04T06:39:17","guid":{"rendered":"https:\/\/www.getastra.com\/blog\/?p=49978"},"modified":"2026-11-04T12:09:21","modified_gmt":"2026-11-04T06:39:21","slug":"is-emergent-ai-safe","status":"publish","type":"post","link":"https:\/\/www.getastra.com\/blog\/ai-security\/is-emergent-ai-safe\/","title":{"rendered":"Is Emergent AI Safe? Independent Pentest Findings"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Is Emergent AI safe? A fair question indeed for anyone about to ship a customer-facing app from emergent.sh. Or even outside of that.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Emergent is one of the fast-blooming leaders in turning plain-language prompts into full-stack web and mobile apps. What we checked is how their security holds up.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Consider this a security-focused <a href=\"https:\/\/emergent.sh\/\" target=\"_blank\" rel=\"noopener\">Emergent<\/a> AI review. We gave four AI coding platforms the same security-explicit prompt, then attacked each app.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Two_disclosures_before_the_findings\"><\/span><strong>Two disclosures before the findings<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">First, Emergent is a paying Astra customer; its application was built on a paid plan, the other three on free tiers. Emergent\u2019s free tier produced only a minimal app, so a paid plan was the only way to match the others. A paid plan may also bring a more capable model or higher limits, so read Emergent-specific numbers with that in mind.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Second, we funded and ran this study independently, and no platform got advance notice or special access.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Is_Emergent_AI_safe_What_our_pentest_found\"><\/span><strong>Is Emergent AI safe? What our pentest found<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We confirmed 41 vulnerabilities in the Emergent app: 0 Critical, 7 High, 23 Medium, and 11 Low. The High findings matter most, because they cluster around broken object-level access:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Customer records exposed by changing IDs<\/li>\n\n\n\n<li>A pagination bypass that allowed a full database dump<\/li>\n\n\n\n<li>Leaked password hashes<\/li>\n\n\n\n<li>Session tokens that stayed valid after logout<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">We also confirmed CORS that reflected arbitrary origins while allowing credentials, and tokens that lived up to 168 hours in localStorage. Broken object-level access turns one ordinary account into a window to everyone\u2019s data, and nothing on the surface hints at it.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Emergent_security_in_context\"><\/span><strong>Emergent security in context<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We tested one app, built from one prompt, in Q2 2026. Platforms update often, so your app may differ. We didn\u2019t set out to rank platforms, and we aren\u2019t arguing against using Emergent. We\u2019re arguing for testing what vibe-coding builds.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Check_your_Emergent_app_in_5_minutes\"><\/span><strong>Check your Emergent app in 5 minutes<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1199\" height=\"1312\" src=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/cdn-blog.getastra.com\/2026\/11\/1a7dac20-confirmed-api-security-risk-checklist.png\" alt=\"Confirmed Emergent security checklist\" class=\"wp-image-49982\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Run these checks before you launch:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>From a different origin, run fetch(url, { credentials: &#8216;include&#8217; }) against your API. It should throw a CORS error.<\/li>\n\n\n\n<li>Request <code>\/api\/users <\/code>without logging in. It should be blocked, not return password hashes.<\/li>\n\n\n\n<li>Reuse a captured token after logging out. The server should reject it.<\/li>\n\n\n\n<li>Decode your token at jwt.io and check exp. It shouldn\u2019t last days, and it shouldn\u2019t sit in localStorage.<\/li>\n\n\n\n<li>As a low-privilege user, request another user\u2019s record by ID. You should get a 403 or 404.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Emergent security shifts every time you prompt a new feature, so re-test after major changes.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1920\" height=\"933\" src=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/cdn-blog.getastra.com\/2026\/09\/ff3fbe05-image.png\" alt=\"Let the agents loose - autonomous pentesting Astra\" class=\"wp-image-48990\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.getastra.com\/autonomous-pentesting\">Autonomous pentesting<\/a> can repeat these attacks on every release. The full report includes the complete Emergent checklist and a corrected prompt, <a href=\"https:\/\/www.getastra.com\/reports\/vibe-coding-security-risks-study\">;download it here<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"FAQs\"><\/span>FAQs<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list \">\n<div id=\"faq-question-1793704876382\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \"><strong>Is Emergent AI safe?<\/strong><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Treat Emergent AI like any AI app builder: it\u2019s well suited to prototyping, but test your app in depth before you bring in real customer data. Security depends on what your prompts actually specify and what your code enforces. <\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1793704931889\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \"><strong>Is Emergent AI legit?<\/strong><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Yes. The company announced a $70 million Series B in January 2026 and reports more than 5 million users. Funding and user numbers don\u2019t speak to how secure any individual app is, so the security checks still matter. <\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1793704947623\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \"><strong>How to secure my Emergent app?<\/strong><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Name your public routes and require authentication on everything else. Restrict CORS to an explicit allowlist and never expose password hashes. Shorten token lifetimes, revoke tokens on logout, and test each rule from outside the app. <\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>Is Emergent AI safe? A fair question indeed for anyone about to ship a customer-facing app from emergent.sh. Or even outside of that. Emergent is one of the fast-blooming leaders in turning plain-language prompts into full-stack web and mobile apps. What we checked is how their security holds up. Consider this a security-focused Emergent AI &#8230; <a title=\"Is Emergent AI Safe? Independent Pentest Findings\" class=\"read-more\" href=\"https:\/\/www.getastra.com\/blog\/ai-security\/is-emergent-ai-safe\/\" aria-label=\"Read more about Is Emergent AI Safe? Independent Pentest Findings\">Read more<\/a><\/p>\n","protected":false},"author":111,"featured_media":49981,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[761],"tags":[],"class_list":["post-49978","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai-security"],"_links":{"self":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts\/49978","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/users\/111"}],"replies":[{"embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/comments?post=49978"}],"version-history":[{"count":3,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts\/49978\/revisions"}],"predecessor-version":[{"id":50006,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts\/49978\/revisions\/50006"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/media\/49981"}],"wp:attachment":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/media?parent=49978"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/categories?post=49978"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/tags?post=49978"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}