Vibe coding is growing fast. The security risks are growing faster.
SUMMARY
- AI coding tools let non-developers build functional software in hours, but working code and secure code are two different things
- Research across 5,600 vibe-coded applications found more than 2,000 vulnerabilities and 400 exposed credentials in live production apps
- Under the Australian Privacy Act, businesses are legally responsible for data security regardless of how the software handling that data was built
- Any vibe-coded tool handling customer data should be assessed by an independent cyber security provider before or shortly after going live
Most offices now have at least one tool that someone built themselves – a booking form, a client intake portal, a simple internal dashboard. They used an AI coding assistant, described what they wanted in plain English, and had something running before the end of the day avoiding development time and cost.
The problem is that the app working is not the same thing as the app being safe. And right now, most businesses putting these tools in front of customers have no way of knowing which one they have.
The gap between functional and secure
AI coding tools are designed to produce software that does what you asked. Security is not their primary objective, and the research is starting to show that clearly.
Wiz scanned 5,600 vibe-coded applications and found more than 2,000 vulnerabilities and 400 exposed secrets, including API keys and credentials, in apps that were live and serving real users. Georgia Tech’s Vibe Security Radar confirmed 74 security vulnerabilities directly traceable to AI coding tools, with 35 appearing in March 2026 alone, more than all of 2025 combined.
Veracode tested over 100 large language models on security-sensitive coding tasks and found that 45% of AI-generated code samples introduce serious vulnerabilities, a rate that has not improved across multiple testing cycles from 2025 through early 2026. The tools are getting faster however the security gap is not closing at this stage.
Your login credentials may be sitting in plain text
Research on vibe-coded applications has found recurring hardcoded secrets and common credentials across many generated apps, including predictable passwords and API keys. Because these values are often reused, they can be exploited with simple guessing or token-forging attacks rather than sophisticated techniques.
AI-generated code leaks secrets, like passwords, API keys, and access tokens, more than twice as often as code written by humans, showing up in 3.2% of cases compared to 1.5%, according to GitGuardian’s 2026 report. That difference compounds quickly across a business building multiple internal tools.
The software might be installing things you did not ask for
AI coding tools occasionally suggest or install software packages that do not exist. Attackers have started registering those non-existent package names with malicious code attached, so when the generated app tries to install the dependency, it installs the malicious version instead. Research by Spracklen et al. found that at least 5.2% of packages suggested by commercial AI coding models are fabricated, and 43% of those hallucinated names appear consistently across repeated runs, making them predictable targets.
This is not a theoretical edge case. It happens in the background during development, with no visible indication that anything went wrong.
Fixing the code by asking the AI to fix it does not work
The instinct when something looks wrong is to prompt the AI again and ask it to correct the issue. The research suggests this makes things worse. According to a controlled experiment published by Cornell University, critical vulnerabilities increased by 37.6% after just five rounds of AI-assisted code refinement. Iterating on AI output does not self-correct security flaws, it compounds them.
The person reviewing the output also needs to understand what they are looking at. Most business owners and operations staff building with these tools do not have a security background, which means vulnerabilities can sit in production indefinitely without anyone recognising them.
What happened when one founder shipped without a review
In late January 2026, Moltbook launched as an AI social network. Its founder said he had not written any code for it, relying on AI tools. Within days, security researchers at Wiz discovered the application had exposed its entire production database, including 1.5 million API authentication tokens, 35,000 email addresses, and private messages.
The root cause was a misconfigured deployment setting. An experienced engineer doing a standard review would have caught it. No review happened because the app went straight from prompt to production.
Australian privacy law does not have an exemption for AI-built software
Under the Privacy Act 1988, your business is responsible for the security of any personal information you collect and store. The method used to build the software is irrelevant. A vibe-coded booking form that leaks customer contact details or payment information carries the same legal exposure as a breach in any other system.
A notifiable data breach triggers mandatory reporting to the Office of the Australian Information Commissioner and direct notification to affected individuals. For many small businesses, the reputational damage from that notification outweighs the technical cost of the breach itself.
What to do if your business is already using these tools
The answer is not to stop using AI coding tools. They are genuinely useful and they are not going away. The answer is to close the gap between what the AI produced and what you put in front of customers.
Any vibe-coded tool that handles customer data, processes payments, or connects to your other business systems needs an independent security assessment. That means someone outside the build process reviewing the environment the application runs in, the access controls around it, and the data it touches. Your cyber security provider should be doing this, not the same person who built the tool.
If you have tools already running in production that went live without a review, a security assessment of your current environment is a practical starting point. You may not know what is already exposed. Learn more how to adopt AI safely here.
The IT Agency helps keep businesses connected, protected, productive and supported through cyber governance, compliance, AI and managed IT solutions. As a Microsoft Solutions Partner and SMB1001 Gold Certified MSP, we help businesses simplify IT, implement technology securely and strengthen resilience. Talk to us about building a more secure and future-ready business.
Frequently Asked Questions
Vibe coding is the practice of building software by describing what you want in plain English to an AI tool, which then generates the code automatically. Tools like Cursor, GitHub Copilot, and Claude Code are commonly used this way.
Yes, if the output is put into production without a security review. AI tools optimise for functionality, not security. Research consistently finds that a significant proportion of AI-generated code contains vulnerabilities that would be caught by a standard review process.
Anything that collects customer information, handles payments, manages logins, or connects to other business systems carries meaningful risk if built without a security review. Client portals, booking systems, membership platforms, and payment forms are common examples.
Under the Australian Privacy Act 1988, the business responsible for the data is responsible for its security, regardless of how the software handling that data was built. AI-generated code does not change that obligation.
Get an independent security assessment of the tool and the environment it runs in. Your IT or cyber security provider should review access controls, data handling, and how the application connects to your other systems. The sooner this happens, the better.
Research suggests this approach does not work reliably. Repeated AI-assisted refinement has been shown to increase vulnerabilities rather than reduce them. Independent review by a qualified cyber security provider is the appropriate step.
References
https://onout.org/vibers/blog/vibe-coding-security-risks/
https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-generated-code-vulnerability-surge-2026/
https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-generated-code-security-vibe-coding-202/
https://equixly.com/blog/2026/04/07/vibe-coding-security/
https://beyondscale.tech/blog/vibe-coding-security-risks-enterprise
https://arxiv.org/abs/2506.11022
https://modall.ca/blog/vibe-coding-security-risks
https://www.ibm.com/think/insights/vibe-coding-security-risks
https://www.oaic.gov.au/privacy/notifiable-data-breaches
The IT Agency
The IT Agency helps businesses stay connected, protected, productive and supported through cyber governance, compliance, AI and managed IT solutions.