Vibe coding sounds relaxed by name alone, describe what you want, let the AI handle the rest, no stress. The actual security research on what that code looks like once it exists tells a considerably less relaxed story, and it is worth reading the real numbers rather than either the hype or the panic around this.
What the Research Actually Found
A few independent studies now exist, and they broadly agree with each other. Veracode's own research found that AI-generated code introduces security flaws in 45 percent of cases it tested, and its most recent report describes the pass rate for AI-generated code security as having stalled rather than improved. The Cloud Security Alliance found that 62 percent of AI-generated code solutions contain design flaws or known vulnerabilities, even when the latest AI models were used. A separate study, reported by Kaspersky, found that 20 percent of vibe-coded apps have serious vulnerabilities or configuration errors. These are not fringe numbers from a single alarmist source. They are close enough to each other, from different researchers, to treat as a real pattern rather than a one-off finding.
Why "It Works" Does Not Mean "It Is Safe"
The most useful distinction in all of this research is between code that works and code that is secure, because those turn out to be almost entirely separate questions. One academic benchmark found that AI coding agents produce functionally correct code, meaning it does what it was asked to do, well over half the time. Of that functionally correct code, only somewhere between 8 and 11 percent was actually secure. In plain terms: the app running perfectly in front of you is close to meaningless as a signal of whether it is safe. It can do exactly what you asked and still have a serious security gap sitting quietly underneath, because "does it work" and "is it safe" were never the same test.
The Mistakes That Show Up Most Often
Across all of this research, the same handful of problems come up repeatedly: secret keys and passwords written directly into the code instead of kept separately, login and permission checks that are incomplete, and database security settings left switched off by default. We go through the fuller list, including the structural and reliability problems that are not strictly security issues but cause real damage anyway, in everything AI-generated code usually gets wrong.
Does This Mean You Should Not Use AI to Build
No, and none of the research says that either. AI coding tools are genuinely useful for getting something built quickly, and that speed is real value, not an illusion. What the research says is narrower and more useful than "don't do this": treat anything built this way as work in progress rather than a finished product, and get it properly reviewed before real users, real money, or real customer data are riding on it. The mistake is not using the tool. The mistake is skipping the review step because the demo worked.
What This Means for Your Specific App
Statistics about AI-generated code in general are useful for context, but they cannot tell you what is actually true of your app specifically, only someone reading your actual code can do that. If you are trying to work out whether your situation has crossed the line from "probably fine for now" into "this needs a proper look," our piece on signs your AI-built app needs a professional look walks through the practical triggers, and our code cleanup service is built specifically around finding out for certain rather than guessing.