A Worrying Trend Emerges in the World of Vibe-Coded Apps: Security Flaws Galore
The use of artificial intelligence (AI) to assist or perform code generation, known as vibe coding, is on the rise. According to a report from Hostinger, 90% of developers now regularly use at least one AI tool at work. While this trend promises to accelerate development and reduce costs, it has also raised concerns about the security of apps developed with the help of AI.
Xint.io, a web platform that delivers AI-driven autonomous pentest code, decided to investigate the security implications of vibe coding by analyzing over 400 vibe-coded apps. The results are alarming: a staggering 434 exploitable security issues were found across all the tested apps, including 196 in greenfield (new) apps and 238 in a hardened app that had been migrated to a modern architecture.
The most common flaws identified in the study include missing controls for rate limiting and Denial of Service (DOS), which accounted for nearly one-third of all security issues. Resource exhaustion/DOS, authorization, and access boundary/traversal/SSRF flaws were also prevalent. These types of vulnerabilities can have serious consequences, including runaway server costs or a server that an attacker can easily take down.
The study’s findings suggest that the primary cause of these security issues is not necessarily the AI code itself, but rather the lack of attention paid to security by developers who rely on vibe coding tools. “Don’t just check if AI code compiles; look for how it performs and the resources it consumes in runtime,” advises Xint.io.
Another concerning trend emerged from the study: secrets exposure was the top source of critical-severity flaws, with hardcoded or default secrets being the most common issue. Debug-mode Remote Code Execution (RCE) accounted for another six critical findings.
The size of the app also appears to play a significant role in introducing security weaknesses. While fine-grained authorization holds up on small apps, it breaks down as the app grows. “Double-check granular object permissions as the amount of endpoints in an application increases,” suggests Xint.io.
Despite these concerns, the study’s authors are optimistic about the future of vibe coding. They found that AI-generated code has improved significantly in areas such as injection flaws and IDOR/BOLA-style access-control bugs. This suggests that the foundational labs behind these tools have genuinely made progress in addressing these security issues.
The takeaway from this study is clear: while vibe coding offers many benefits, it also introduces new security risks if not used properly. Developers who rely on AI code generation tools must be aware of these potential pitfalls and take steps to address them. By understanding the weaknesses in vibe coding, developers can play to its strengths and create more secure apps for users.
As the use of AI in development continues to grow, it’s essential that security professionals stay vigilant and work closely with developers to identify and mitigate security risks associated with vibe coding.
Source: SecurityWeek — 2026-07-22