Notifications
Clear all
Topic starter
19/08/2026 3:33 pm
TL;DR: AI-generated code can pass functional tests while failing security checks, with one Carnegie Mellon benchmark finding 61% functional pass rates but only 10.5% security pass rates, according to Equixly's analysis of recent research. That gap means security must be validated against the running application, not assumed from prompts or source review alone.
NHIMG editorial — based on content published by Equixly: Vibe coding security, the gap between working and safe code
By the numbers:
- An AI coding scanner found 970 security issues across 7 vibe-coded MVPs, including 801 high-severity weaknesses.
Questions worth separating out
Q: How should teams secure AI-generated applications before they reach production?
A: Treat security as a precondition of generation, not a review step at the end.
Q: Why do vibe-coded applications create NHI and secrets risk?
A: Because AI-generated code often embeds machine credentials directly into the application, such as API keys, JWT secrets, and database passwords.
Q: What breaks when AI tools are allowed broad write access to internal systems?
A: Broad write access turns an AI tool from a helper into an unreviewed operator.
Practitioner guidance
- Enforce security acceptance criteria before generation Write threat-modelled security requirements alongside functional requirements before an AI coding assistant generates a feature, and block release until those requirements are tested in the running application.
- Automate secrets detection in every pipeline Scan commits, pull requests, and build artefacts for hardcoded API keys, JWT secrets, database passwords, and certificates before code reaches shared environments.
- Adversarially test the API layer Probe authentication, object-level authorisation, error handling, and rate limiting with malicious inputs and broken-session scenarios, because those are the failure points AI-generated code most often hides.
What's in the full article
Equixly's full blog post covers the operational detail this post intentionally leaves for the source:
- Benchmark examples showing how specific AI coding models fail on secure implementation choices across different languages and tasks
- The exact attack patterns seen in vibe-coded apps, including indirect prompt injection, fabricated packages, and lies-in-the-loop approvals
- Practical testing guidance for continuous penetration testing against APIs and business logic flaws
- Specific examples of security checks that dynamic testing surfaces when static analysis does not
👉 Read Equixly's analysis of vibe coding security gaps and AI-generated code risk →
Vibe coding security: are your controls keeping up with AI code?
Explore further
19/08/2026 4:15 pm
Vibe coding security is really application security under compression. The article shows that AI does not invent new security principles, it accelerates the consequences of skipping them. Functional correctness and security assurance are now decoupled, which means teams need explicit controls for review, testing, and release gating. The practitioner conclusion is simple: if the code ships faster than it is tested, security debt accumulates immediately.
A question worth separating out:
Q: Who is accountable when an AI coding tool introduces insecure code into production?
A: Accountability stays with the organisation that allowed the tool to operate without enforced guardrails. The model is not the accountable party. Security, engineering, and platform owners share responsibility for defining policy, enforcing it at runtime, and logging the decision trail that proves controls were applied.
👉 Read our full editorial: Vibe coding security exposes the gap between working and safe code
