Application Security Vibe-Coded Apps Riddled With Exploitable Security Flaws Analysis found 434 exploitable flaws in AI-generated apps, with denial-of-service, authorization and secrets exposure risks among the most common issues. By Kevin Townsend | July 22, 2026 (9:00 AM ET) Flipboard Reddit Whatsapp Whatsapp Email Vibe-coding is increasing. Vibe-coded apps tend to be buggy. Is this a worrying sign for the future? Vibe coding, the use of AI to assist or perform code generation, is increasing dramatically. In May 2026, Hostinger reported, “90% of developers regularly use at least one AI tool at work as of January 2026.” This is likely to increase through the basic business pressure that applies to everything: we need more, faster and cheaper. But while vibe coding is increasing in volume, so are concerns over the security of vibe-developed apps. Xint.io, the web platform that delivers Theori’s AI driven autonomous pentest code (Xint), decided to analyze vibe-coded apps to quantify what, where, why and how often vibe coding introduces security weaknesses into the apps it touches. To achieve this, Xint created three tests reflecting the most common AI-assisted development workflows: on a new app from a well-written spec (greenfield, as with an experienced developer overseeing the process) on a new app representing the growing incidence of the casual coder saying, ‘just build this’ (greenfield) on a hardened app (Gnuboard7) to see if hardening introduced new vulnerabilities (the brownfield comparison). Although Gnuboard7 (a legacy PHP app) is an established app, Xint needed to examine it as if it were an AI-assisted app. So, they migrated it into a Laravel + React architecture “and asked AI to harden it.” The migration created a contemporary baseline so the vulnerabilities found would reflect AI reasoning limits, not legacy quirks. Each app was given a 30-minute scan for runtime and source code analysis by Xint. It found a total of 434 exploitable security issues: 196 in the greenfield apps, and 238 in the single brownfield app. Advertisement. Scroll to continue reading. The primary conclusions reached by Xint.io cover four areas: the most common flaws in AI code; the most common severe flaws; the effect of the app size on the flaws introduced; and has AI made any advances in producing secure code? Missing controls for rate limiting and DOS are the most common flaws . Resource exhaustion/DOS accounted for 93 of the 434 flaws. Authorization and insecure direct object reference, where users get access to data beyond their permissions, came second with 88 flaws; and access boundary/traversal/SSRF flaws were third with 54. Such flaws occur when the developer only asks for features. “The impact is not data theft, but in real operation it means runaway server cost or a server an attacker can knock over,” warns the report. Xint’s advice: “Don’t just check to see if AI code compiles; look for how it performs and the resources it consumes in runtime.” Secrets exposure is the top source of critical-severity flaws. There were 23 critical findings, with hardcoded or default secrets the most common at 11. Debug-mode RCE accounted for another six. “Look for hardcoded secrets, such as API keys or PII, embedded in code produced by AI,” advises Xint. Size matters . “Fine-grained authorization holds up on small apps but breaks as the app grows,” warns the report. While IDOR flaws comprised just 11% of the flaws in the smaller greenfield apps, they comprised 28% in the larger brownfield Gnuboard7 app. “Double check granular object permissions as the amount of endpoints in an application increases,” suggests Xint. Despite these continuing flaws being introduced by vibe coding, Xint’s fourth conclusion is that vibe coding AI is improving . Before starting the analysis, Xint had expected to find a large number of injection flaws (SQLi, XSS) and IDOR/BOLA-style access-control bugs. It found the opposite. Injection barely showed up, while IDOR/BOLA flaws were far less common than expected. “This suggests the foundational labs have genuinely improved in these areas,” comments the report. The purpose of the Xint study was not to demonstrate that vibe coding introduces bugs (that was already known), nor to stop companies using vibe coding (that isn’t going to happen). However, knowing the most common flaws and understanding how and why they occur can help developers overcome them – either by including prompts that eliminate the flaws and/or checking for their existence after generation. By understanding the weaknesses in vibe coding, developers can play to its strengths in the future. Related : Everybody Is Vibe Coding But Nobody Told the Security Team Related : Backslash Raises $19 Million to Secure Vibe Coding Related : Vibe Coding Tested: AI Agents Nail SQLi but Fail Miserably on Security Controls Related : Vibe Coding: When Everyone’s a Developer, Who Secures the Code? Written By Kevin Townsend Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Kevin Townsend CISO Conversations: Andreas Gaetje – From Economics to CISO at Körber AG AI Data Centers Are Being Built Faster Than They Can Be Secured Windows Bind Link Attacks Can Hide Malware From EDR Tools Hacker Conversations: Jesse McGraw (GhostExodus), From Blackhat Hacker to Redemption UK Government Rolls Out Agentic AI Defense Plan Alongside Industry Pledge CISO Conversations: Tarah Wheeler, Cybersecurity Leader, Thought Leader and Original Thinker Decades-Old Bash Tricks Expose AI Coding Agents to Supply Chain Attacks Hacker Conversations: Chris Thompson, Former Head of IBM X-Force Red, Co-Founder of RemoteThreat Latest News StrongestLayer Raises $4.1 Million in Seed Funding Extension Fourth SharePoint Vulnerability Exploited in Past Month’s Wave of Attacks Endpoint Security Firm Glow Launches With $180M in Funding at $1.2B Valuation Oracle Patches Over 1,400 Vulnerabilities With Quarterly Security Updates Ransomware Group Threatening to Leak Data Stolen From Coca-Cola’s Fairlife OpenAI Says Its AI Models Broke Loose and Hacked Hugging Face Trump Orders Defense Contractors to Map Software, Suppliers Across Critical Supply Chains Cisco Launches Low-Cost AI Models for Source Code Security Trending Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Closing the Exploitation Gap July 22, 2026 Join this live webinar as we explore why exploitation is outpacing remediation, where risk is growing fastest, and what security leaders can do to close the gap before attackers take advantage. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the Move Jazz has named Sean Robinson, Rickie Goyal, Danielle Guetta, Shani Nago, and Lior Magram as VPs and Michael Calev as COO. AJ Shipley has been appointed Chief Product Officer at CrowdStrike. Brinqa has named Ron Dovich as Chief AI and Automation Officer, David Allen as CTO, Steve Biagioni as CFO, and James Walta as VP of Product. More People On The Move Expert Insights Legacy Systems, Real-World Impacts: The Reality of OT Security Legacy systems, safety concerns, and critical infrastructure risks make OT vulnerability disclosure one of cybersecurity's most challenging balancing acts. (Tod Beardsley) The Shift Toward Business-Aligned Risk Management Moving from isolated, technical data to a continuous risk lifecycle can help organizations align security controls with actual business consequences. (Steve Durbin) How to Conduct a Successful Audit of AI-Driven Software Development As AI-generated code becomes commonplace, CISOs need new audit strategies to measure developer practices, govern AI tool usage, and identify software risks before they reach production. (Matias Madou) Frontier AI: Six Questions Every Enterprise Should Ask Security Vendors From model selection and automation to validation and measurable results, the right questions can help enterprises separate genuine AI capabilities from marketing hype. (Joshua Goldfarb) The AI Token Costs That Can Break Cybersecurity As cybersecurity platforms embrace agentic AI, organizations must balance detection performance against the escalating costs of token consumption, deployment architecture, and AI credits. (Danelle Au) Flipboard Reddit Whatsapp Whatsapp Email