16,500+ live GitHub files still hotlink a dead Unsplash endpoint. Public AI-coded landing pages ship picsum.photos and placehold.co in production. Here's the data, the named repos, and the two-minute fix.
source.unsplash.com/random — an endpoint Unsplash retired in mid-2024. It returns HTTP 503. Every page that ships one of these URLs shows a broken-image icon in production.picsum.photos URLs shipping to production — random photos that don't match the surrounding content.Unsplash deprecated source.unsplash.com/random in mid-2024. No official replacement. The endpoint has been returning 503 Service Unavailable for over a year, and Unsplash has confirmed it is never coming back.
An authenticated GitHub code-search today returns:
| Language | File hits |
|---|---|
| JavaScript | 7,856 |
| HTML | 6,016 |
| TypeScript | 1,444 |
| Vue | 1,012 |
| Svelte | 114 |
| Astro | 105 |
| Total | ≈ 16,547 |
Repo-deduped to ~885 unique public repositories after filtering to stars ≥ 5, non-archived, issues enabled, and pushed in the last 12 months. The full research note lists 13 well-known OSS projects currently shipping <img> tags that 503 in production, including nuxt/website-v2 (2,252★), guocaoyi/create-chrome-ext (2,116★), and debridmediamanager/debrid-media-manager (1,266★ — PR merged April 2026).
<img src="..."> that 503s still loads. It just loads nothing. HTML lints don't flag dead external URLs; deploy previews don't block on missing images; humans reviewing AI-coded PRs skip past the "standard" image tile. The URL was correct the day it was generated — and Unsplash's deprecation happened silently from the perspective of anyone who wasn't reading their blog.AI coding agents (Claude Code, Cursor, Codex, Windsurf, v0, Bolt, Lovable) were trained on GitHub circa 2023-2024 — back when source.unsplash.com/random/1200x800 was the canonical "random image" snippet. It appeared in thousands of starter kits, tutorials, and boilerplates. When asked to build a landing page today, the agent emits exactly that dead URL because it's what the training data said was the right answer.
The user reviews the PR, approves it (the image tile looks plausible in local dev because the cached image hasn't flushed), deploys, and ships a site with gray broken-image icons where every photo should be.
We scanned the public landing pages of eight AI-website-builder platforms (2026-04-22, via our public scanner):
| Platform | source.unsplash/random | placehold.co family | picsum.photos |
|---|---|---|---|
| v0.dev | 0 | 0 | 0 |
| bolt.new | 0 | 0 | 0 |
| lovable.dev | 0 | 0 | 0 |
| onlook.com | 0 | 0 | 0 |
| tempo.new | 0 | 0 | 0 |
| magicpath.ai | 0 | 0 | 0 |
The platforms are clean. Their users' output is not. A spot-check of youdeservenow.com — a real AI-coded product launch — returned 234 unique picsum.photos URLs, each producing a random photo unrelated to the surrounding content. This is the characteristic signature of an agent that was told "put a nice image here" and defaulted to the easiest URL it could remember.
Two fixes solve this at different scales:
grep -RIn "source.unsplash.com/random" .
If you get a hit, every user of your repo is looking at a broken image tile right now. Replace the dead URL with either a pinned Unsplash URL (images.unsplash.com/photo-<id>?w=1200&h=800&fit=crop), a self-hosted JPG, or — for AI-coding workflows — a tteg save call that writes a real photo into the repo.
Give the agent a deterministic recipe for "image here" instead of "put a nice image":
uv tool install tteg
tteg save "startup office" ./public/hero --orientation landscape
# saves ./public/hero.jpg — a real Unsplash photo
Or at render time, no install needed:
curl "https://tteg-api-53227342417.asia-south1.run.app/search?q=coffee+shop&n=1"
# returns { image_url, width, height, author, attribution, ... }
No API key. No Unsplash developer account. No .env. CORS enabled. Free tier: 50 queries/day per IP.
Paste any preview URL into the public scanner:
https://tteg.kushalsm.com/scan?url=<your-preview-url>
The scanner reports every unique placeholder / broken / random image URL on the page, with a one-line fix per pattern. No login, no account.
/search/code filtered by language, paginated to 1000 results per language, repo-deduped, filtered to repos with ≥ 5 stars, non-archived, issues enabled, pushed in the last 12 months. Full protocol and the counting script in RESEARCH.md § Reproducing the search.tteg.kushalsm.com/api/fetch) that strips CORS. Six pattern families: source.unsplash.com/random, placehold.co, via.placeholder.com, dummyimage.com, picsum.photos, loremflickr.com.If this data helps something you're writing, please link rather than copying — the underlying GitHub numbers drift week-to-week as repos get fixed or forked.
Kushal SM. "State of Images in AI-Generated Landing Pages (2026)."
https://tteg.kushalsm.com/state-of-ai-landing-page-images-2026.html (2026-04-22)
Scan any URL →