One might argue that data breaches been there way before AI, the difference with these AI generated apps is:

- They are an easy target, they don’t need any sophisticated hacking knowledge (article mentions inspecting network calls in browsers).

- There tons of those, and more created everyday. For the average user, they don’t know what they are using, or how risky it can be.

I can confirm that no advanced hacking techniques were used, and anyone with a moderate understanding of how the web works will be able to reproduce the results.

The initial idea behind the analysis was to start with the most basic setup and then move on to more sophisticated attacks. We never reached that second part, as so much sensitive data was already out in the open.

Some don't even need to be hacked. The person just thought they didn't need a login and left everything open.