Vibe coding: How AI is increasing software development security risks

What only a few years ago looked like an experiment or a supporting tool for isolated tasks has now become part of the everyday software development workflow.

Developers are increasingly using generative AI models to write code, create API requests, generate SQL queries, configure cloud infrastructure, automate testing, and even analyze errors. Tools such as OpenAI, GitHub Copilot, and Anthropic have already become common elements of modern development environments.

AI enables teams to create code at unprecedented speed. However, security processes are struggling to keep pace and prevent potential vulnerabilities in time. According to Veracode, only 55% of AI-generated coding tasks resulted in secure implementations. In other words, in 45% of tested scenarios, the model generated code containing known security flaws. Similar findings were confirmed by Cloud Security Alliance.

AI coding has already become the new normal

Today, development teams create and update code significantly faster thanks to AI assistants. According to the 2025 Stack Overflow Developer Survey, 84% of developers already use or plan to use AI tools in the development process. For comparison, that number was 76% in 2024.

Source: Stack Overflow

This is an important signal for businesses. AI coding is no longer an experiment for a small group of enthusiasts. It has become part of the modern software development lifecycle (SDLC).

Engineers are increasingly moving away from manually writing every line of code. Instead, they:

• generate code snippets through prompts;
• use AI to create business logic;
• automate repetitive tasks;
• receive ready-to-use suggestions directly within their development environment.

For businesses, this creates obvious advantages: faster product delivery, shorter time-to-market, improved team productivity, and accelerated DevOps processes. At the same time, however, the very nature of software security risks is changing.

What is vibe coding, and why is everyone talking about it?

Alongside the rise of generative AI, a new development approach known as vibe coding has rapidly gained popularity.

This is a development style in which engineers rely heavily on AI-generated suggestions and rapid code generation rather than manually reviewing every implementation detail.

Simply put, a developer describes a task in a prompt, receives generated code, and adapts it to their needs.

In practice, this means AI:

• generates application logic;
• creates API calls;
• proposes cloud infrastructure configurations;
• adds libraries and dependencies;
• builds authentication flows;
• automatically fixes errors.

While this level of automation saves a tremendous amount of time, it also gradually changes the behavior of development teams. Instead of carefully reviewing implementations, teams increasingly face what researchers call the “illusion of correctness”: the generated code looks logical, compiles successfully, and passes basic checks — which automatically makes it appear trustworthy.

This is precisely what increasingly concerns AppSec and DevSecOps teams today.

AI-assisted development creates a new class of security risks

Artificial intelligence does not understand business context or the requirements of a specific organization. It does not know internal security policies, architectural limitations, or regulatory requirements. It cannot evaluate business risks or understand the criticality of specific systems.

AI models simply predict the most statistically likely code fragment based on their training data. And if that data contains insecure or outdated coding patterns, the model may reproduce them in new projects.

The problem is not only the existence of vulnerabilities — it is the scale at which they can spread. AI enables teams to generate code far faster than before. If previously one developer could accidentally introduce one vulnerability, AI can now replicate insecure patterns across dozens of services, repositories, or microservices at once. As a result, increased productivity also leads to increased security debt and technical debt accumulation.

The most common risks found in AI-generated code

Unsafe authentication logic

AI tools may generate simplified or insecure authentication and authorization mechanisms, including improper token validation, weak session handling, incorrect role-based access control, and insufficient API authorization checks.

At first glance, such code may appear functional, but in practice it can open the door to account compromise.

Embedded secrets and access keys

API keys, tokens, passwords, cloud credentials, and other hardcoded secrets remain one of the most common issues in generated code.

The problem of secrets leakage continues to scale alongside modern development and automation practices. In environments actively using AI assistants, the risk becomes even greater because insecure code fragments can rapidly spread between projects. According to GitGuardian, the number of leaked secrets increased by 152% between 2021 and 2025.

Unsafe dependencies and libraries

AI often recommends libraries and packages without validating their security or relevance. As a result, organizations may automatically add vulnerable dependencies, use outdated components, or propagate known vulnerabilities across multiple projects.

For DevSecOps teams, this creates a new level of operational complexity because insecure dependencies can spread significantly faster.

Data leakage and prompt injection

Another category of risks is related to interactions between developers and AI models. While working with generative AI tools, developers may unintentionally upload internal code to external services, include sensitive information in prompts, or expose confidential business data.

At the same time, the risk of prompt injection attacks is increasing — manipulations of prompts designed to bypass intended logic or produce unintended outputs.

Unreliable cloud infrastructure configurations

AI is increasingly used to generate Infrastructure as Code templates, Kubernetes configurations, Terraform files, and cloud policies. However, AI models may generate overly permissive access configurations, segmentation errors, insecure IAM policies, publicly exposed resources without proper protection etc.

In large environments, these issues can create major risks even before systems reach production.

Why traditional AppSec can no longer keep up

Traditional security tools such as Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) remain critically important. However, they only begin operating after the code has already been written.

AI has fundamentally changed development velocity, code volume, release frequency, and delivery cycles. As a result, security teams face more vulnerabilities and false positives, less time for analysis, and reduced visibility into how code was created.

Traditional AppSec practices were designed for human-scale development speed. AI-assisted development changes both the scale and the pace of modern application development.

That is why developer security awareness is becoming increasingly important — practical skills for securely working with AI-powered coding tools are now essential.

Secure development in the AI era

Modern security strategies are gradually shifting from “finding issues after code is written” to “preventing unsafe code from appearing in the first place.”

This is where developer education becomes critical.

Teams need an understanding of secure coding principles, but also practical skills for safely interacting with AI coding tools, including:

• writing secure prompts;
• validating generated code;
• identifying insecure patterns;
• assessing risks in AI-generated logic;
• preventing insecure practices from reaching production.

How Secure Code Warrior adapts to AI use

Secure Code Warrior AI Vibe Coding introduces an approach designed specifically for the realities of AI-assisted development.

Instead of focusing on abstract theory, the platform emphasizes practical developer readiness for a world where AI has already become part of the SDLC.

The solution helps teams:

• securely use AI tools;
• recognize insecure patterns in generated code;
• build secure coding habits;
• evaluate developer readiness;
• reduce AI-generated vulnerabilities.

A particular focus is placed on vibe coding scenarios — situations where rapid development speed and heavy reliance on AI suggestions create a new category of business risk.

As a result, organizations gain more than just another security tool — they gain a way to adapt engineering teams to the era of AI-driven development.

An important role in this approach goes to Trust Agent AI, a solution designed to help teams evaluate the trustworthiness of AI-generated code during development itself. The platform analyzes interactions between developers and AI assistants, helps identify potentially risky code fragments, and provides contextual recommendations for the secure use of generated code. This is particularly important for organizations where code generation speed is increasing much faster than the ability to manually review it.

Conclusion

Artificial intelligence has already become part of modern software development — and its role will only continue to grow in the coming years. But alongside productivity gains comes a growing scale of potential security risks.

Code generated by AI assistants is not automatically secure. In fact, the speed of code generation is beginning to outpace organizations’ ability to verify its security properly.

That is why secure AI usage is no longer only a technical concern. It has become part of the broader cyber resilience strategy of modern businesses.

Organizations that start building a culture of secure AI-assisted development today will have far greater chances to scale development without simultaneously scaling vulnerabilities.