We security-checked
35 AI-built web apps

All results

Each app was rated “problem,” “note” or “no problem,” using rules fixed before the checks. A note means nothing dangerous, but something a publisher should know.

All eight notes were for apps that save what you type in the browser.

What we checked

Every check was mechanical. We opened each app on our own computer with all outside connections blocked, and looked at:

• whether it loads parts (code, styles, fonts) from other sites
• whether it tries to connect to outside servers
• whether it stores anything in the browser
• whether it runs text as code
• whether text typed into a field ends up running as page markup or code
• whether typed text can become a link that runs code when clicked
• whether API keys or passwords are written directly into the code

For the input checks we used harmless text that only raises a flag if it runs. We first confirmed the checks catch these problems in a sample we made unsafe on purpose.

Server-side code (the login page, the contact form and the image board's server) was not run; we inspected the code only.

25 apps built with conditions

The first group is the 25 apps from EXP-003: shogi, a spreadsheet, a paint app, a 3D maze and more. Those requests said not to use outside assets, libraries, network access or browser storage.

All 25 kept to those conditions. No outside loading, no outside connections, no browser storage, and no typed text that ran.

Most of the 25 are games, and 15 have no input fields, so input handling could only be checked on the other 10.

10 apps built with no conditions

For the second group we asked the way most people would, with no conditions at all: one sentence such as “Please make a to-do list web app.” We never asked for anything to be secure.

The first three (a to-do list, a comment section and a profile maker) had no problems. So we switched the remaining seven to requests where risks tend to appear: login, connecting to outside services, sending email, and turning typed text into formatted output.

None of the 10 loaded outside parts, and in none of them did typed text run. The test text we typed always appeared on screen as plain text.

In the Markdown notes and the link board we also typed a link meant to run code when clicked. Neither turned it into a link.

Safeguards the AI added on its own

Five of the seven riskier apps added protections that were never requested. We confirmed each one in the code.

• Login: passwords are stored in a form that cannot be reversed (scrypt). It also blocks forms submitted from other sites and limits failed login attempts
• Contact form: line breaks and control characters are stripped from one-line fields, which stops attacks that rewrite email headers. It also has a hidden field against bots and a limit on repeated sending
• Image board: it checks the first bytes of each upload to confirm it really is an image, refuses SVG, and stores delete keys in a form that cannot be reversed
• Link board: only addresses starting with http or https become links
• Markdown notes: link and image addresses are checked, and forms that run code (such as javascript:) are not displayed

The two apps with a Node.js server (login and image board) were both set by default to be reachable only from the same computer, which keeps them from being exposed to the internet by accident.

What to know before publishing

No problems turned up, but there are three things worth knowing before you put an AI-built app online as is.

What you type stays in that browser

The eight apps rated “note” save what you type in the browser. It stays on the user's own computer or phone and is not sent anywhere. On a shared computer, though, the next person may see it, and clearing browser data deletes it.

Check how apps that use outside services handle keys

The AI chat app does not write an API key into its code; each user types their own, and it goes straight from the browser to the AI service. With that design, the publisher's own key cannot leak through the code. If you write your own key into the code and publish it, anyone can read it. Before publishing, check whether the AI left a place in the code for you to paste a key.

The AI did not run what it built

We only let the AI write files for these 10 apps, and all 10 reported that they had never been run. Separately from safety, someone needs to check that an app actually works before it goes live.

Try the apps

Eight of the 10 apps built without conditions run entirely in the browser; use “Try it” in the table above. For the three that need a server, the code is available to read.

• On this site the apps run in a frame cut off from the rest of the page, with outside connections blocked. The weather app and the AI chat cannot reach their services, so they cannot show weather or reply
• Browser storage is not available inside the frame, so whatever you type is lost when you reload
• We did not change the apps' code to publish them. We only combined each app into one file and added security settings