Vibe Coding Boom Brings a Measurable Surge in Security Flaws

The pitch is working

Vibe coding, the practice of describing software in plain language and letting an AI agent build it, has moved from curiosity to commercial force. The core promise is simple. You no longer need to know how to program to produce a website or app. The output may have real limitations, but it far exceeds what someone without significant technical skill could otherwise build 5. That framing treats vibe coding as an early look at how AI could change who gets to make things 5.

The money suggests the market agrees. Lovable, one of the best-known platforms, reportedly reached $400 million in annualized revenue in February 2026, up from $100 million 1. Its headline success story is a solo founder with no development background who used Lovable to build a virtual try-on tool and grew it past $800,000 in annual recurring revenue in nine months 1. The same analysis says 84% of AI coding tool adoption in 2026 now involves non-technical founders, though it describes that figure inconsistently, at one point saying 84% of users have no engineering background 1. The exact number is fuzzy. The direction is not.

The bill arrives

The security research tells a less flattering story, and the sources agree with each other closely.

API security firm Escape.tech scanned more than 1,400 vibe-coded applications running in production. It found security issues in 65% of them, and 58% had at least one critical vulnerability 3. The scan turned up more than 400 exposed secrets and 175 instances of exposed personal data, including bank account information 3. Even the founder-friendly analysis that celebrates the revenue wins cites the same figures 1. When the optimists and the security analysts quote the same 65% number, it is hard to wave away.

At Georgia Tech's School of Cybersecurity and Privacy, researchers built what they call the Vibe Security Radar after finding that nobody was systematically tracking vulnerabilities tied to AI-generated code 2. After combing through more than 43,000 security advisories, the tool had confirmed 74 cases. Of those, 14 were rated critical and 25 high, involving flaws such as command injection, authentication bypass, and server-side request forgery 2.

The growth rate matters more than the total. The Cloud Security Alliance reports that CVEs formally attributed to AI-generated code rose from 6 in January 2026 to 35 in March, roughly a sixfold increase in two months 34.

Why the official count is too low

The confirmed numbers are almost certainly an undercount. The Georgia Tech radar works by tracing metadata such as co-author tags and bot email addresses 2. Many AI tools leave no such trace in commit histories. Researchers therefore estimate the true count of AI-linked vulnerabilities is 5 to 10 times higher than what has been confirmed 34. The Georgia Tech team says it has only scratched the surface 2.

Broader testing points the same way. Depending on methodology, between 45% and 70% of AI-generated code samples fail security tests. The most common failures are authorization flaws, missing access controls, and hardcoded credentials 4. That last category ties into a wider problem: GitGuardian documented 28.65 million new hardcoded secrets in public GitHub commits in its 2026 secrets-sprawl report 3. That figure isn't limited to AI-written code, but it shows how much exposure already exists.

There is also a newer supply-chain risk. AI assistants sometimes recommend software packages that don't exist, and roughly 19.7% of suggested dependencies in some ecosystems fall into this category, according to the Cloud Security Alliance 4. An attacker who registers a commonly hallucinated package name could slip malicious code into projects whose builders never checked.

The reading

These are not two separate stories, one about access and one about risk. They are the same story. The feature that makes vibe coding valuable, removing the need to understand the code, is also what makes its failures predictable. A founder who cannot read authentication logic cannot tell when it is missing. The recurring flaw types in the research, including access control gaps, leaked keys, and injection bugs, are exactly the kinds of problems that experienced engineers catch in review and newcomers don't know to look for.

None of this undoes the democratization argument 5. It does change the economics. The $800,000 try-on tool and the 58% critical-flaw rate come from the same population of builders 13. As vibe-coded apps take on payments and personal data, someone will pay for the security review that was skipped: the founder, the platform, or the users whose data leaks. The platforms that build security scanning and secret detection into the default workflow, rather than leaving it to users who don't know it exists, are the ones most likely to keep this boom from turning into a breach cycle.