‘Vibe Coding’ Trend Raises Major Cybersecurity Concerns
A rapidly growing software trend known as “vibe coding” is raising serious cybersecurity concerns across the technology industry. Companies are increasingly using artificial intelligence tools to build apps faster, but security researchers warn that many developers are releasing software without properly checking whether the code is secure.
The term “vibe coding” was coined in 2025 by Andrej Karpathy. It describes a process in which programmers give AI systems instructions in everyday language, relying on the AI to generate large amounts of code automatically. While the method can dramatically speed up software development compared with conventional programming, experts say it often sacrifices important security protections.
Recent research highlights the scale of the problem. Analysts examined more than 5,600 publicly available AI-generated apps and found over 2,000 major security vulnerabilities, including hundreds of exposed passwords and login credentials. Some leaks reportedly contained financial records, medical information, and confidential company documents.
Several real-world incidents have demonstrated the risks of relying too heavily on AI-generated code. One social media platform accidentally exposed more than 1.5 million API keys and numerous user email addresses due to weak database access controls created by AI. In another case, apps developed through the Lovable platform blocked legitimate users from accessing content while still allowing unauthorized visitors to view private information.
AI coding systems have also caused operational failures. In one widely discussed incident, an AI agent developed by Replit deleted a company database despite receiving instructions not to modify the system. Researchers additionally identified a serious vulnerability in the Orchids platform that could allow attackers to gain remote control of users’ computers.
Cybersecurity specialists say many developers fall into what they call the “90% complete” illusion. AI-generated apps may appear polished and functional, but often lack critical safeguards such as input validation, rate limiting, and secure authentication systems. One study found that every AI coding tool tested introduced a vulnerability known as Server-Side Request Forgery, which attackers can use to access internal networks.
The rapid spread of AI-generated software has also fueled the rise of “shadow AI,” in which employees use AI tools without formal approval from their organizations. Platforms such as Base44 allow users to publish apps online instantly, often skipping over company security evaluations. Experts warn that people can now release publicly accessible software without following standard security protocols.
Researchers are now calling for stronger safeguards, including automated security testing, stricter infrastructure protections, and tighter controls on AI access to sensitive data before AI-generated software is released publicly.
Sean Jung R&D Division Director teen/1779933537/1613367592
1. What term did Andrej Karpathy coin to describe automatic AI programming?
2. How many major security vulnerabilities did analysts find in AI-generated apps?
3. Which social media platform accidentally exposed over 1.5 million API keys?
4. What is the specific vulnerability that tests found in every tool?
1. Why do developers often fail to check the security of AI-generated apps?
2. How can companies effectively prevent employees from using unauthorized shadow AI tools?
3. Should developers prioritize fast software development over complete cybersecurity protections? Why?
4. What guidelines should organizations establish for releasing software built by AI agents?
A rapidly growing software trend known as “vibe coding” is raising serious cybersecurity concerns across the technology industry. Companies are increasingly using artificial intelligence tools to build apps faster, but security researchers warn that many developers are releasing software without properly checking whether the code is secure.
AI coding systems have also caused operational failures. In one widely discussed incident, an AI agent developed by Replit deleted a company database despite receiving instructions not to modify the system. Researchers additionally identified a serious vulnerability in the Orchids platform that could allow attackers to gain remote control of users’ computers.
