Vibe coding, which involves using artificial intelligence to assist in code generation, is on the rise. According to a report by Hostinger, by January 2026, 90% of developers were utilizing at least one AI tool in their work. This trend is driven by the demand for faster, more cost-effective development processes.
Increasing Concerns Over Security
Despite the rise in AI-assisted coding, concerns about the security of applications developed through vibe coding methods have also grown. Xint.io, a web platform offering Theori’s AI-driven autonomous pen-testing services, conducted an analysis to identify where and how security vulnerabilities are introduced in vibe-coded applications.
The study involved three tests reflecting common AI development workflows: creating new applications from well-written specifications, developing new apps in a more casual manner, and hardening existing applications, using Gnuboard7 as a test case.
Findings of the Security Analysis
Xint.io’s analysis included a 30-minute scan of both runtime and source code, uncovering 434 exploitable security issues. Of these, 196 were in the newly developed applications, while 238 were found in the hardening test of the legacy app Gnuboard7.
The study highlighted several common vulnerabilities, including missing controls for rate limiting and denial-of-service (DOS) protections, which accounted for 93 flaws. Authorization issues and insecure direct object references (IDOR) were the next most prevalent, with 88 instances identified.
Recommendations for Developers
Xint.io’s report emphasizes the importance of not only ensuring that AI-generated code compiles but also examining its runtime performance and resource consumption. The exposure of hardcoded secrets, such as API keys, remains a critical concern, with 23 high-severity issues identified.
The report advises developers to scrutinize their applications for embedded secrets and to verify granular object permissions, especially as applications scale and the number of endpoints increases.
Future Outlook for Vibe Coding
Despite the persistent vulnerabilities, Xint.io’s findings suggest that AI coding tools are improving in some areas. Contrary to expectations, injection flaws and certain access control vulnerabilities were less common, indicating progress in those domains.
The purpose of the study was not to deter the use of AI in coding but to enhance awareness of potential security flaws. By recognizing and addressing these vulnerabilities, developers can leverage the strengths of vibe coding while mitigating its risks.
Understanding the limitations and capabilities of vibe coding will be crucial for developers aiming to build secure applications in the rapidly evolving tech landscape.
