What security risks does vibe coding carry?

By the QuantumSec team

"Vibe coding" is a term coined by Andrej Karpathy in 2025 to describe a way of programming where the developer describes what they want in natural language, accepts the AI-generated code without reviewing it in depth, and trusts that it works. It's incredibly effective for rapid prototyping. And it's a potential source of serious security vulnerabilities once that code reaches production.

Why AI-generated code isn't secure by default

Language models generate plausible code, not secure code. They were trained on billions of lines of code from public repositories, where insecure examples are as common as secure ones. The model learns to generate code that compiles, that passes basic tests, that solves the stated problem. It doesn't learn to reason about the security implications of that code in the specific context of your application.

Most frequent vulnerabilities in AI-generated code

According to Stanford studies and our own analysis, the most frequent vulnerabilities in LLM-generated code are: 1. SQL injection — the model generates queries by concatenating variables without parameterization. 2. Hardcoded secrets — API keys, passwords and tokens directly in the code. 3. Weak authentication — JWT or session implementations with insecure default settings. 4. XSS — direct insertion of user data into the DOM without sanitization. 5. Path traversal — file path handling without validation. 6. IDOR (Insecure Direct Object Reference) — access to resources by ID without checking permissions. 7. Outdated dependencies — the model suggests library versions it knows from its training data, which can be old versions with active CVEs.

The "copy, paste, don't understand" problem

The main risk of vibe coding isn't technical, it's cognitive. A developer who doesn't understand the code they're accepting can't identify when that code has a security problem. There's no visual indicator, no compilation error, no failing test when there's a SQL injection or a hardcoded secret. The vulnerability only becomes apparent when someone exploits it.

How to mitigate the risks of AI-generated code

The most effective measures: 1. Never deploy code you don't understand, regardless of who or what generated it. 2. Integrate SAST (static application security testing) tools into your CI/CD: Semgrep, Snyk and CodeQL are solid options. 3. Add security review as part of code review: at least one reviewer should actively look for vulnerabilities. 4. Run a security audit before launch, especially if the product handles sensitive data. 5. Train your team on the OWASP Top 10: understanding the most common vulnerabilities is the prerequisite for spotting them in AI-generated code.

FAQ

Is vibe coding inherently insecure?

Not inherently, but it does introduce specific risks that require specific countermeasures. AI-generated code can be perfectly secure if it's reviewed by someone who knows what to look for, tested with security tools, and audited before handling sensitive data.

Which AI tools generate more secure code?

The most recent models (GPT-4o, Claude Sonnet, Gemini 1.5 Pro) tend to generate more secure code than earlier models because they've been specifically tuned to avoid common insecure patterns. However, no model guarantees secure code by default. The tool matters less than the review process.