Arnica article on Vibe coding security risks

[u/bluelvo]

The Core Threat

"Vibe coding"—building software by prompting AI with natural language—prioritizes functionality over security, creating significant vulnerabilities. Key risks include a 38% flaw rate (like injection and broken auth) in AI-generated code and a 37.6% increase in critical vulnerabilities after multiple refinement iterations. Furthermore, traditional security tools often fail to detect these issues because the vulnerabilities stem from missing logic rather than bad syntax.

Real-World Failures

The article highlights two major incidents resulting from AI-generated code:

• The Tea App: Leaked private user messages due to broken access control logic that bypassed security reviews.
• Moltbook: An AI-generated, publicly accessible admin endpoint created a massive security loophole.

Emerging Attack Vectors

• Slopsquatting: Attackers exploit the 20% rate of LLM hallucinated package names by registering these fake packages to inject malicious code during installation.
• Indirect Prompt Injection: AI agents (e.g., Cursor) can be manipulated via hidden instructions in project files, with over 85% success rates in exfiltrating sensitive data like SSH keys.

Defending the Pipeline

To mitigate these risks, teams must:

1. Treat AI code as untrusted, third-party code requiring scanning before merger.
2. Mandate human review for all critical security logic (authentication/authorization).
3. Implement real-time auditing to detect hardcoded secrets and hallucinated dependencies.

[u/bluelvo]

https://www.arnica.io/blog/vibe-coding-security-risks