Vibe Coding — The New Era of Programming and Its Cybersecurity Risks

In 2025-2026, the world of programming changed radically. Vibe coding — the term coined by Andrej Karpathy in February 2025 — describes a new approach to software development where you describe what you want in natural language, and AI writes the code for you. Sounds great. But it is a cybersecurity catastrophe waiting to happen.

What is vibe coding?

Vibe coding is a programming style where the developer uses a large language model (LLM) — like Claude, GPT-5, Cursor, GitHub Copilot — to generate code by describing intent in natural language. Karpathy defines it: "You see things, say things, run things, copy paste things, and it mostly works."

The approach is revolutionary — it allows people without formal technical education to build apps, MVPs, scripts and even entire startups. This democratizes programming and accelerates innovation. But there is a dark side.

Why is vibe coding popular?

The dangers of vibe coding

1. AI generates vulnerable code

A 2025 Stanford study showed that code written with AI assistants has 40% more vulnerabilities than human-written code. The reason? AI models are trained on legacy GitHub code — which includes millions of bugs and vulnerabilities.

Typical vulnerability that AI generates:

# AI generated code — VULNERABLE
@app.route("/login", methods=["POST"])
def login():
    username = request.form["username"]
    password = request.form["password"]
    query = f"SELECT * FROM users WHERE username='{username}' AND password='{password}'"
    result = db.execute(query)  # SQL Injection!
    if result:
        return "Logged in"

2. Hardcoded credentials and API keys

62% of analyzed vibe-coded GitHub repositories contain hardcoded credentials — passwords, API keys, AWS tokens. AI models often place placeholders like API_KEY = "your_key_here", which vibe coders replace with real keys and push to public repos.

3. Lack of input validation

AI models often generate code that accepts user input without checks. This opens the door to XSS, Path Traversal, Command Injection and dozens of other attacks.

4. Outdated dependencies and supply chain attacks

Vibe coders rarely update dependencies. AI installs packages with known vulnerabilities. In 2024-2025 we saw multiple supply chain attacks via compromised npm/PyPI packages — vibe coders were primary victims.

5. Nobody understands the code

The biggest danger is lack of understanding. Karpathy describes it: "When I get error messages, I just copy paste them with no comment, usually that fixes it."

The result? Production code that nobody on the team understands. When an incident happens at 3 AM, there is nobody to debug it. When a security patch needs to be added — nobody knows where to start.

How to do vibe coding safely?

For individual developers

For business and companies

1. Establish AI code policy — which tools are allowed, how AI-generated code is reviewed before commit
2. Mandatory security review on every AI-generated code before deploy
3. SAST/DAST tools in CI/CD — automated scanning on every PR
4. Penetration testing on vibe-coded apps before production. Learn more
5. Develop Incident Response plan. See our service

Free security tools