Vibe Coding Security: Why AI-Built Apps Ship So Many Flaws

Growth and risk at the same time

Building software by describing it in plain English has moved from novelty to normal practice. Lovable, one of the best-known prompt-to-app platforms, has reportedly passed a $600 million annual revenue run rate 5. Non-technical founders, freelancers, and small teams now use prompt-led tools for prototypes, internal dashboards, landing pages, and small SaaS experiments 5. By 2026, platform vendors were publishing official guides to "vibe coding" and one-click deployment, and business media were explaining the practice to general audiences 5.

The security research is far less upbeat. Several independent studies, using different methods, point in the same direction: apps built mostly by AI coding assistants ship with more vulnerabilities than code written by people.

What the studies found

The largest recent dataset comes from Symbiotic Security. Its three-month study examined 1,967 public GitHub repositories and 1,072 live vibe-coded apps across five platforms, cross-checked with ten scanners, and logged 87,826 vulnerabilities in total 1. AI-assisted repositories averaged 42.3 vulnerabilities, compared with 9.6 for human-only repositories, a 4.4x gap. Ninety-eight percent of the vibe-coded apps had at least one flaw 1.

Academic work reached similar conclusions. One audit of 200 deployed vibe-coded repositories found 180 of them, or 90%, were vulnerable, with 1,471 flaws in total. Broken access control was the most common category at 36% 1. The SUSVIBES benchmark tested 186 real-world tasks across 12 agent configurations. The best setup produced functionally correct code 57% of the time but secure code only 11.8% of the time, and 79.3% of the correct solutions still contained vulnerabilities 1.

Other figures fit the same pattern. Georgetown's CSET found cross-site scripting flaws in 86% of AI-generated code samples across five major models 2. Cloud Security Alliance data shows AI-assisted commits expose secrets at about twice the human rate, 3.2% versus 1.5% 2. Apiiro's analysis of Fortune 50 codebases found 322% more privilege-escalation paths and 153% more design flaws in AI-generated code 2. Attributed CVEs also rose sharply, from 6 in January 2026 to 35 in March 2.

Georgia Tech researchers have started tracking this problem directly. Their Vibe Security Radar searched more than 43,000 security advisories and has confirmed 74 vulnerabilities linked to AI coding tools so far. Fourteen are rated critical and 25 high, and they include command injection, authentication bypass, and server-side request forgery 3. Because the tool relies on signals such as co-author tags and bot email addresses, the team says it has likely found only a fraction of the real total 3.

Why the numbers differ

The headline multipliers are not the same across studies. Symbiotic reports 4.4x 1. A December 2025 CodeRabbit analysis of 470 pull requests found about 1.7x more issues overall and up to 2.74x more security vulnerabilities in AI-written code 4. Escape.tech scanned 5,600 deployed vibe-coded apps and found more than 2,000 high-impact vulnerabilities and 400 exposed secrets, which works out to roughly one serious, exploitable flaw for every three apps 4.

These figures measure different things, so they do not contradict each other:

• "At least one vulnerability" covers everything, including minor issues. That explains how 98% 1 and "one in three" 4 can both be accurate.
• "High-impact" counts only serious flaws, which produces the lower Escape.tech figure 4.
• Pull requests versus whole repositories versus live apps also shift the baseline.

The ranges also say something useful. Almost every vibe-coded app has some weakness, and a substantial minority have one an attacker could exploit right away.

Flaws in design, not just syntax

The types of flaws matter more than the counts. Broken access control 1, too-broad permissions 2, and authentication bypass 3 are not typos. They are design mistakes. An AI model asked for code that "works" will often give a cloud function wildcard access to every S3 bucket, because that is the fastest route to a working result 2. Traditional static analysis tools tend to miss these logic and authorization gaps, as well as newer risks such as hallucinated package dependencies 2.

Attackers are also adapting. They now target the coding agent itself, through poisoned rules files, tampered MCP configurations, and "slopsquatting," which means publishing malicious packages under names that AI models tend to invent 2.

Takeaway

The most plausible reading is that vibe coding is not uniquely broken. It is producing software at scale, written by people who often cannot judge whether it is secure. The 57%-correct versus 11.8%-secure result from SUSVIBES 1 captures the core issue: the model's goal is code that runs, and users see a working app, so the security gap stays hidden until someone exploits it.

As platforms like Lovable grow 5, secure defaults will probably matter more than user discipline. That means locked-down database access, secret scanning before deployment, and authorization checks built into templates. Until platforms provide those safeguards, anyone shipping a prompt-built app should treat it as an untested prototype and have it reviewed before it handles real user data.