Vibe-Coded Apps Riddled With Exploitable Security Flaws
A recent study by Xint.io, a web platform specializing in AI-driven penetration testing, analyzed the security vulnerabilities introduced by ‘vibe coding’ – the increasing use of AI to assist in code generation. The study found a significant number of exploitable flaws in both newly developed and legacy applications, with missing rate limiting controls and secrets exposure being the most prevalent issues. Despite concerns about the growing trend of AI-assisted coding, the research indicates that AI models are showing some progress in producing more secure code, particularly in areas like injection flaws and access control.
Vibe coding, the practice of utilizing AI to assist in code generation, is rapidly increasing in prevalence. Xint.io, a web platform specializing in AI-driven penetration testing, conducted a study to quantify the security implications of this trend. The research aimed to understand the types of vulnerabilities introduced by AI-generated code and how they manifest in different application contexts.
To assess the security of vibe-coded apps, Xint created three test scenarios: a new, well-written application (greenfield), a new application representing casual coding requests (“just build this”), and a hardened legacy application (Gnuboard7). Gnuboard7, a PHP application, was migrated into a Laravel + React architecture and then ‘hardened’ using AI to establish a contemporary baseline for comparison.
Each app underwent a 30-minute scan for runtime and source code analysis. The study identified a total of 434 exploitable security issues, with 196 found in the greenfield apps and 238 in the brownfield Gnuboard7 app. The most common flaws included missing rate limiting and DOS controls (93 flaws), followed by authorization and insecure direct object reference (88 flaws), and access boundary/traversal/SSRF flaws (54 flaws).
According to Xint.io, the impact of these flaws isn’t necessarily data theft, but rather potential issues like runaway server costs or server takeover by an attacker. The research also highlighted that granular authorization holds up on small apps but breaks down as the application grows, and IDOR flaws were more prevalent in larger brownfield applications.
Despite the ongoing vulnerabilities, Xint’s analysis revealed a positive trend: AI models are improving. Initially, the researchers expected to find a high number of injection flaws (SQLi, XSS) and IDOR/BOLA-style access-control bugs, but these were significantly less common than anticipated. This suggests that the underlying AI models are becoming more secure in these areas.
The study’s purpose was not to demonize vibe coding or discourage its use, but rather to provide developers with insights into the most common vulnerabilities and how they arise, enabling them to proactively address these issues through improved prompts and post-generation checks.