Vibe coding is a development approach in which a person describes what they want in natural language and AI writes the code, often without line-by-line review. The speed gain is real, and working code does not mean secure code.
AI delivers what was requested, and security requirements rarely appear in the request. The episode Vibe coding: the AI-created vulnerability, from the Ares Killchains Breakdown series, shows an attack chain starting with this type of flaw.
Which vulnerabilities appear most often?
The most common is missing authorization: the code checks whether the user is logged in, but not whether they are entitled to that data. Changing an identifier in the URL reveals another customer's data. It is one of the most common application testing findings, described in the OWASP Top 10 as broken access control.
Others include secrets in code, such as API keys and database passwords hard-coded to make the system work, unvalidated user input used in queries and commands, and permissive configurations, such as enabled debug modes and public cloud storage.
AI-suggested dependencies
AI suggests libraries based on statistical patterns, not evaluation. Sometimes it recommends older versions with known vulnerabilities. In other cases, it suggests packages that do not exist, and attackers already publish malicious packages under those names, hoping someone will install them.
Every suggested dependency must be checked: whether it exists, whether it is maintained, and whether the version has a known flaw.
A problem of scale
Developers also write insecure code. With AI, the volume produced per person increases while review time per line decreases. Some of that code is now written by non-developers, such as an analyst building an automation or a team publishing an internal dashboard for testing, without going through engineering's security lifecycle.
The result is an attack surface growing faster than the ability to review it.
AI has also accelerated the attacker's side. In the August 2025 threat intelligence report, Anthropic described a criminal who used a coding agent to automate reconnaissance, credential harvesting, and intrusions into the networks of at least 17 organizations.
How to use AI securely in development
Practices that reduce risk:
- Security in the request: request input validation, authorization checks, and secrets kept outside the code.
- Review before publishing: generated code is a draft until someone reviews it.
- Automatic verification: secret scanning, dependency analysis, and static analysis in the pipeline.
- Verified dependencies: existence, maintenance, and known vulnerabilities.
- An approved path for non-developers: an environment with rules and review.
- Test what is exposed: continuous offensive validation of deployed applications.
With new code going live every week, an annual test covers only what existed on the day of the test, as discussed in the article on continuous pentesting.
Secure development and continuous validation
Vultus builds secure development programs that also include nondevelopers and combines this work with autonomous pentesting of exposed applications. Explore Vultus secure development program and the autonomous AI pentesting.
