--- title: "Vibe Coding: when AI-generated code multiplies vulnerabilities" description: AI-generated code is introducing vulnerabilities at an increasing rate. With 74 CVEs attributed to AI code in three months, application security is a priority. image: https://blog.pradeo.com/hubfs/Template%20article%20(32)-1.png --- [![pradeo_logo_color](https://blog.pradeo.com/hs-fs/hubfs/pradeo_logo_color.png?width=220&height=33&name=pradeo_logo_color.png "pradeo_logo_color")](https://pradeo.com) - Solutions - [Mobile Threat Defense](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/) - [Secure Private Store](https://pradeo.com/en/solutions/mobile-device-security/secure-private-store/) - [Mobile Application Compliance Audit](https://pradeo.com/en/solutions/mobile-application-security/application-compliance-audit/) - [Runtime Application Self Protection](https://pradeo.com/en/solutions/mobile-application-security/rasp/) - [Shielding](https://pradeo.com/en/solutions/mobile-application-security/application-shielding/) - [Application Security Testing](https://pradeo.com/en/solutions/mobile-application-security/application-security-testing/) - Use cases - [Cybersecurity in MDM/ UEM](https://pradeo.com/en/use-cases/cybersecurity-in-mdm-uem/) - [Securing mobile devices](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/) - [Securing Mobile Applications](https://pradeo.com/en/solutions/mobile-application-security/application-security-testing/) - [Malware / leakware protection](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/) - [Phishing protection](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/) - [Ensuring compliance for applications](https://pradeo.com/en/compliance/) - [Ensuring compliance for mobile fleet](https://pradeo.com/en/compliance/) - [Securing BYOD](https://pradeo.com/en/solutions/mobile-device-security/secure-private-store/) - [Become partner](https://pradeo.com/become-partner/) - Resources - [Solution briefs](https://pradeo.com/en/resources/?solution-briefs) - [Customer Cases](https://pradeo.com/en/resources/?customer-cases) - [Integration briefs](https://pradeo.com/en/resources/?integration-briefs) - [White Papers](https://pradeo.com/en/resources/?white-papers) - [Analyst reports & guides](https://pradeo.com/en/resources/?analyst-reports-guides) - [On demand webcast](https://pradeo.com/en/resources/?webcasts-on-demand) - [About us](https://pradeo.com/en/about/) - [Blog](https://blog.pradeo.com/) - [Contact](https://pradeo.com/contact/) - en - [**FR**](https://blog.pradeo.com/fr) - [**DE**](https://blog.pradeo.com/de) ### Topics - Select a Topic ### Stay up to date SUBSCRIBE TO OUR BLOG ### Stay up to date [Mobile Application Security](https://blog.pradeo.com/topic/mobile-application-security) # Vibe Coding: when AI-generated code multiplies vulnerabilities ![Picture of Clara Campos](https://blog.pradeo.com/hubfs/1711636314862%20(1).jpg) By [Clara Campos](https://blog.pradeo.com/author/clara-campos) on June, 18 2026 [mailto:?subject=Take%20a%20look%20at%20this%20article](mailto:?subject=Take%20a%20look%20at%20this%20article) ![](https://blog.pradeo.com/hubfs/Template%20article%20(32)-1.png) In three months, **74 vulnerabilities** were directly attributed to code generated by artificial intelligence. "Vibe coding", which involves describing desired features in natural language and letting AI generate the corresponding code, has become widespread in 2026. While this approach offers considerable productivity, it poses a major risk when the generated code is deployed to production without going through an adequate verification process.   ## A growing number of vulnerabilities in AI-generated code  The [Vibe Security Radar](https://vibe-radar-ten.vercel.app/) project, launched in 2025 by the Systems Software & Security Lab at Georgia Tech, **tracks CVEs directly introduced by AI-generated code**. Its methodology relies on analysing vulnerability databases and tracing each fix back to its original commit, to determine whether an AI coding tool introduced the flaw. The results speak for themselves. In January 2026, [6 CVEs](https://www.infosecurity-magazine.com/news/ai-generated-code-vulnerabilities/) were directly attributed to AI-generated code. In February, 15, and in March, 35. **74 confirmed vulnerabilities in three months**, with an acceleration curve that mirrors the adoption of AI coding tools. And researchers estimate that the [**real figure is 5 to 10 times higher**](https://research.gatech.edu/bad-vibes-ai-generated-code-vulnerable-researchers-warn), as most AI-generated commits carry no signature that would identify them as such.   ## Why vibe coding poses a security problem The risk does not come so much from artificial intelligence itself as from the volume of code it produces without sufficient verification. This results in recurring vulnerabilities (SQL injections, XSS, insecure storage, hardcoded secrets, insufficient authentication, weak cryptography) reaching production at an unprecedented scale and speed. AI-assisted developers produce code [3 to 4 times faster](https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-generated-code-vulnerability-surge-2026/), and **introduce security flaws at a proportional rate**. This is amplified by a confidence bias. The generated code compiles, passes functional tests, and is often integrated with less human review than manually written code. **OWASP has [updated its Top 10 in 2026](https://cyberpress.org/owasp-releases-2026-top-10-list/)**, integrating for the first time risks related to the software supply chain, a vector directly amplified by AI-generated code. Another risk vector stems from AI's tendency to reference dependencies that do not exist. According to a [USENIX Security study](https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-generated-code-vulnerability-surge-2026/), nearly 20% of packages referenced in AI-generated code are purely fictitious. Attackers exploit this phenomenon, called **"slopsquatting"**, by registering these package names invented by AI to place malicious code in them, creating an entirely new supply chain attack vector.   ## When AI Coding tools themselves become targets The risk is not limited to the code AI produces. **AI coding tools themselves have become [attack targets](https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-generated-code-vulnerability-surge-2026/)**, opening a new vector for software supply chain compromise. In July 2025, an attacker exploited a [misconfigured GitHub token](https://aws.amazon.com/security/security-bulletins/AWS-2025-015/) to inject malicious code into the Amazon Q Developer extension, Amazon's AI coding assistant, for VS Code. The compromised extension was distributed via the VS Code Marketplace for several days before AWS published a fix. The injected code aimed to execute commands on the developer's machine, and only a syntax error in the payload prevented exploitation. The AI code editor Cursor, **used by more than one million developers**, has also been subject to [several CVEs in 2025](https://www.bleepingcomputer.com/news/security/ai-powered-cursor-ide-vulnerable-to-prompt-injection-attacks/). The CurXecute vulnerability allowed an attacker to execute code remotely via a prompt injection through a connected MCP server. MCPoison exploited a similar mechanism by poisoning an MCP configuration file in a shared repository, a developer approving a legitimate configuration could be silently redirected to a malicious one. GitHub Copilot was not spared either. Researchers have already demonstrated that it was possible to inject [invisible Unicode characters](https://thehackernews.com/2025/03/new-rules-file-backdoor-attack-lets.html) into Copilot and Cursor rule files, silently directing the AI to insert malicious code into all generated output, without the developer being able to detect it visually.   ## How Yagaan secures applications built with AI code AI-generated code ends up in web and mobile applications deployed in production. And the researchers' recommendation is clear: it [**must be treated with the same rigour as any unverified third-party code**](https://research.gatech.edu/bad-vibes-ai-generated-code-vulnerable-researchers-warn). This is precisely the core expertise of [Yagaan](https://pradeo.com/en/yagaan-application-security/), powered by Pradeo, whose application security solutions enable the analysis and security of application code, whether written by a developer or generated by artificial intelligence. - [**Yagaan Static Application Security Testing**](https://pradeo.com/en/solutions/mobile-application-security/application-security-testing/) integrates into CI/CD pipelines to analyse source code at every iteration and detect vulnerabilities introduced before production. The solution uses machine learning to prioritise vulnerabilities by their real criticality and provide contextual remediation guidance, enabling developers to fix efficiently without slowing down the development cycle. - For mobile applications built with AI code, [**Yagaan Mobile Application Security Testing**](https://pradeo.com/en/solutions/mobile-application-security/mobile-application-security-testing/) enables security audits from binary code (Android and iOS), identifying third-party components and vulnerabilities, including those introduced by fictitious dependencies generated by AI. As AI-generated code represents a growing share of applications in production, systematic static analysis is no longer optional. It becomes the first line of defence before market release. ###### About The Author [More from this author](https://blog.pradeo.com/author/clara-campos) ![](https://blog.pradeo.com/hs-fs/hubfs/1711636314862%20(1).jpg?height=100&name=1711636314862%20(1).jpg) ###### Clara Campos #### Recommended articles [![Cyber Resilience Act: The first obligations take effect in September 2026](https://blog.pradeo.com/hubfs/Template%20article%20(26)-1.png)](https://blog.pradeo.com/cyber-resilience-act-the-first-obligations-take-effect-in-september-2026) ###### [Cyber Resilience Act: The first obligations take effect in September 2026](https://blog.pradeo.com/cyber-resilience-act-the-first-obligations-take-effect-in-september-2026) - May 7, 2026 [![What is Application Shielding?](https://blog.pradeo.com/hubfs/Template%20article%20(6)-1.png)](https://blog.pradeo.com/what-is-application-shielding) ###### [What is Application Shielding?](https://blog.pradeo.com/what-is-application-shielding) - March 5, 2026 ### Popular articles ### Stay up to date ### Recent articles ### Articles récents [RedHook: the banking trojan that grants itself system-level access on Android](https://blog.pradeo.com/redhook-the-banking-trojan-that-grants-itself-system-level-access-on-android) - 18 June, 2026 [What Google's latest report reveals about mobile threats](https://blog.pradeo.com/what-googles-latest-report-reveals-about-mobile-threats) - 18 June, 2026 [Android: The 4th zero-day vulnerability patched in six months](https://blog.pradeo.com/android-the-4th-zero-day-vulnerability-patched-in-six-months-1) - 18 June, 2026 [Vibe Coding: when AI-generated code multiplies vulnerabilities](https://blog.pradeo.com/vibe-coding-when-ai-generated-code-multiplies-vulnerabilities) - 18 June, 2026 [2026 World Cup: Cyberattacks Target Fans' Mobile Devices](https://blog.pradeo.com/2026-world-cup-cyberattacks-target-fans-mobile-devices) - 18 June, 2026 ### Topics - [Mobile Security (56)](https://blog.pradeo.com/topic/mobile-security) - [Mobile Application Security (46)](https://blog.pradeo.com/topic/mobile-application-security) - [Expertise (31)](https://blog.pradeo.com/topic/expertise) - [Security Alert (30)](https://blog.pradeo.com/topic/security-alert) - [Cybersecurity (29)](https://blog.pradeo.com/topic/cybersecurity) - [News (27)](https://blog.pradeo.com/topic/news) - [Partners (24)](https://blog.pradeo.com/topic/partners) - [Corporate (12)](https://blog.pradeo.com/topic/corporate) - [Events (4)](https://blog.pradeo.com/topic/events) - [Actualité (2)](https://blog.pradeo.com/topic/actualité) - [predictions (2)](https://blog.pradeo.com/topic/predictions) - [cyberattack (1)](https://blog.pradeo.com/topic/cyberattack) see all [![New Call-to-action](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/2378615/ad3111b0-9454-41ff-91f4-9eee95b1f08f.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/2378615/ad3111b0-9454-41ff-91f4-9eee95b1f08f) ### Get in touch with mobile security experts [Contact us](https://www.pradeo.com/en-US/contact-us) [![](https://blog.pradeo.com/hs-fs/hubfs/pradeo_logo_white_square.png?width=90&height=74&name=pradeo_logo_white_square.png)](https://pradeo.com) European leader in mobile security, Pradeo protects business mobile devices and applications. [Read More](https://www.pradeo.com/en-US/) - [Resources](https://www.pradeo.com/en-US/pradeo-ressources#white_papers) - [UEM security](https://www.pradeo.com/en-US/uem-mdm-security) - [Use cases](https://www.pradeo.com/en-US/pradeo-ressources#use-case) - [Data protection](https://www.pradeo.com/en-US/mobile-data-privacy-regulation) - [Contact us](https://www.pradeo.com/en-US/contact-us) - [Mobile Threat Defense](https://www.pradeo.com/en-US/mobile-threat-defense) - [Mobile Application Security Testing](https://www.pradeo.com/en-US/application-security-testing) - [In-App Protection](https://www.pradeo.com/en-US/in-app-protection) - [Secure Private Store](https://www.pradeo.com/en-US/private-app-store) - [Mobile Threat Intelligence](https://www.pradeo.com/en-US/mobile-threat-intelligence#perso-threat-intelligence) ![email.svg](https://cdn2.hubspot.net/hubfs/3067823/awwal/email.svg "email.svg") [contact@pradeo.com](mailto:contact@pradeo.com) Copyright @ 2022. All Right Reserved. - - - ```json { "@context" : "http://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Clara Campos" }, "dateModified" : "June 18, 2026, 7:26:09 AM", "datePublished" : "2026-06-18 07:26:09", "description" : "AI-generated code is introducing vulnerabilities at an increasing rate. With 74 CVEs attributed to AI code in three months, application security is a priority. ", "headline" : "Vibe Coding: when AI-generated code multiplies vulnerabilities", "image" : { "@type" : "ImageObject", "url" : "https://2378615.fs1.hubspotusercontent-eu1.net/hubfs/2378615/Template%20article%20%2832%29-1.png" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://2378615.fs1.hubspotusercontent-eu1.net/hubfs/2378615/Logo%20Pradeo%20D%C3%A9grad%C3%A9%20Long%20Couleurs.svg" }, "name" : "Pradeo" } } ```