Vibe coding security fails: 57% of AI code works, only 11.8% is safe
A new academic benchmark suggests that the code churned out by today’s most popular AI coding agents might work just fine — and still be dangerously easy to hack. The findings raise fresh questions about vibe coding security, the practice of letting large language model agents write software with little human oversight, just as the technique gains traction among developers and companies looking to move faster.
Key takeaways
- Vibe coding lets an LLM agent complete complex coding tasks after a simple human prompt, with minimal supervision during execution.
- Researchers built SUSVIBES, a benchmark of 186 real-world software engineering tasks drawn from open-source projects where human programmers had previously committed vulnerable code.
- Twelve widely used agentic coding setups running frontier AI models were tested against the benchmark, and every single one performed poorly on security.
- SWE-Agent paired with Claude 4 Sonnet produced functionally correct code 57% of the time, but only 11.8% of those solutions were actually secure.
- Adding vulnerability hints to the coding prompts, a simple mitigation strategy, failed to meaningfully improve security outcomes.
What Is Vibe Coding and Why Security Concerns Are Rising
Vibe coding describes a development style where engineers hand a coding task to an AI agent and let it run with minimal check-ins along the way. Instead of writing every line themselves, human programmers prompt the model, review the output at a high level, and move on. The approach has caught on because it can dramatically speed up software delivery, especially for feature requests that would otherwise take a developer hours to implement manually.
… Continue reading the full article at the original source below.
