Vibe coding security risks are the symptom: software stopped being safe to leave unreviewed

AI zero day exploits got cheap, and security moved up the list

As of October 2026, three separate trends point the same way. Each has a hype version and a sober version, and the sober version is still enough to change a budget.

Offense first. In November 2025 Anthropic described a campaign attributed to a Chinese state-sponsored group, in which AI did 80-90% of the work against roughly thirty targets. In May 2026 Google's threat intelligence group reported the first zero-day exploit it believes criminals built with AI: a two-factor authentication bypass, caught before mass use. In April, Claude Mythos Preview turned Firefox bugs into working exploits 181 times where the previous model managed twice (the sandbox story is separate).

Now the corrections. Anthropic's "thousands" of further severe findings is an extrapolation from 198 manually reviewed reports, a point Tom's Hardware made loudly. In the espionage case the model sometimes invented credentials, a plain case of AI hallucination. And Mandiant's M-Trends 2026 says it does "not consider 2025 to be the year where breaches were the direct result of AI".

That last line is the useful one. AI did not invent new ways in, it made the old ones faster. M-Trends measured the hand-off between the group that gets initial access and the group that uses it at more than 8 hours in 2022 and 22 seconds in 2025. Exploits were the top initial vector for the sixth year running, at 32% of intrusions, and the mean time-to-exploit fell to an estimated -7 days, before the patch.

Defenders get the same tools. At the DARPA AI Cyber Challenge finals in August 2025, automated systems found 54 synthetic vulnerabilities and patched 43 at about $152 per task. They also pay a new cost: curl ended its bug bounty in January 2026 after a flood of AI-generated reports, seven in one sixteen-hour stretch, none of them a real vulnerability.

Read it by column. The attack rows are about speed and scale rather than new technique, and the defense rows are mostly about who can afford to run the tools first.

Legacy software security risks grow because AI reads old code faster than you patch

The quieter number behind all this is volume. Jerry Gamblin's review of NVD data counts 48,185 CVEs published in 2025 against 39,962 in 2024, up 20.6%. Then 2026 bent the curve: GTIG's September 2026 analysis shows monthly disclosures doubling from 5,045 in January to 10,740 in August.

GTIG is careful with its own figures. Automated CVE assignment inflates the baseline (Linux kernel entries alone produced about 5,000 CVEs in eight months with no exploited zero-day among them), only 0.23% of 2026 disclosures were ever seen exploited, and GTIG calls the AI link "an early indicator rather than an established trend".

What did get exploited matters more. GTIG counted 141 vulnerabilities disclosed and exploited between January and August 2026, already more than the 127 for all of 2025, and zero-days were 62% of them. Half of all AI-discovered vulnerabilities led to remote code execution, against 26% across all CVEs.

Age does not protect code. Mythos found a 27-year-old bug in OpenBSD, an operating system whose reputation rests on audits, in a run that cost under $50, and Anthropic says fewer than 1% of the potential vulnerabilities it has found are fully patched. If your stack includes a library nobody has touched since 2019, assume someone with a model has read it more carefully than you have.

Most attacks need no zero-day at all. In July 2026 Sysdig documented JadePuffer, ransomware it concluded an LLM agent ran end to end. The way in was CVE-2025-3248, an unauthenticated code-execution flaw in internet-facing Langflow that was fixed in version 1.3.0 in 2025. Then it logged into MinIO with minioadmin:minioadmin, used a 2021 Nacos authentication bypass, fixed a failed payload within 31 seconds, and encrypted 1,342 configuration items with a key it never saved. Paying would not have brought the data back.

Windows 10 reached end of life on 14 October 2025, and StatCounter still shows it on 27.83% of desktop Windows machines worldwide in September 2026. But end of life software risks for a small business are rarely about one old laptop. They are about the self-hosted automation tool someone installed for a pilot and never updated, exactly the profile JadePuffer scanned for.

What are the biggest vibe coding security risks? The same six places

Vibe coding means building software by describing it to an AI model and shipping what it generates without reading the code, a term Andrej Karpathy coined in February 2025. The six recurring vibe coding security risks are missing database rules, broken access control, authentication you can walk around, secrets in code and agent configs, classic injection, and agents with more reach than their task needs. Each has a named incident below. First, the figures, which come from very different methods. The most quoted is Veracode's July 2025 report: across 80 coding tasks and more than 100 models, generated code introduced an OWASP Top-10 vulnerability in 45% of test cases. That is a lab benchmark, not production code, though it is telling that larger models did no better than small ones.

Field data points the same way. Escape.tech scanned more than 5,600 deployed vibe-coded apps, mostly Lovable, and passively found over 2,000 vulnerabilities, more than 400 exposed secrets and 175 personal-data exposures. Georgia Tech's SSLab, as reported by The Register, attributed 74 CVEs to AI-authored code by March 2026, 49 to Claude Code and 15 to GitHub Copilot, and its researcher thinks the real count is 5 to 10 times higher.

Missing database rules. Moltbook, whose founder said he "didn't write a single line of code", shipped a Supabase key in its client-side JavaScript with no row-level security behind it. Wiz found 1.5 million API tokens, about 35,000 emails and 4,060 private conversations open to anyone in February 2026, with write access on top.

Broken access control. Lovable's April 2026 incident, covered in detail by Sekurak (in Polish), was an IDOR: a logged-in user could call API functions on other people's projects and pull their source code, database credentials and chat histories.

Authentication you can walk around. In July 2025 Wiz showed that private Base44 apps, SSO-only enterprise ones included, could be joined by anyone who knew the app's ID through two undocumented registration endpoints. The ID sits in the app's URL. Wix fixed it within a day.

Secrets in code and agent configs. GitGuardian's State of Secrets Sprawl 2026 counts 28,649,024 new secrets on public GitHub in 2025, finds that commits co-authored by Claude Code leak secrets at about twice the baseline, and turned up 24,008 unique secrets in MCP configuration files. Dependencies are the other half of it. In a USENIX Security 2025 study, Spracklen and colleagues generated 576,000 code samples and found that on average at least 5.2% of the packages commercial models suggested did not exist, and 21.7% for open-source models, 205,474 unique invented names in all. Attackers register such names and wait for an agent to install them, a trick now called slopsquatting.

Classic injection. In Veracode's tests, models failed to defend against cross-site scripting in 86% of cases and log injection in 88%, repeating the unsafe patterns the public web is full of.

Agents with too much reach. In July 2026 Pillar Security showed one chain escaping the sandboxes of Codex CLI, Cursor and Gemini CLI through the Docker socket and reaching the user's whole home directory. The agent never broke its sandbox; it asked a privileged local daemon to do the work. Reach also sets the cost of prompt injection: an agent that reads untrusted web pages, tickets or emails can be instructed by them, and it acts with whatever access it holds.

None of these needed a clever attacker, only someone who looked. Generated code works on the happy path and nobody owns the unhappy one, the same gap behind why AI deployments fail.

Triage by blast radius: the review a tool needs depends on what it can reach

Banning vibe coding doesn't work and isn't needed. A marketer's prototype on Lovable is not the same risk as an agent-written payment flow, and treating them alike either strangles useful work or waves dangerous work through. Grade each tool by what it can touch if it breaks, then set the minimum review by grade.

Two rules keep the table honest. A tool changes tier when its data changes, not when its code does: the prototype someone points at the real CRM becomes tier 2 that afternoon. And promotion means a review, not a copy-paste. Moltbook shows what launching without one looks like.

Five things an agent should never write alone

Above the prototype tier, some code should be AI-assisted at most. Each item has a public incident behind it.

Authentication and session logic. Base44 is the example: the login screen worked, and the registration endpoints behind it checked nothing. Auth bugs fail silently, and tests written by the same agent rarely catch them.

Database rules and row-level security. Supabase and Firebase let the browser talk to the database directly, so the rules are the only access control you have. Moltbook is what happens without them.

Payments. Webhook signature checks, idempotency, server-side amount validation. A bug here moves money.

File uploads. Type and size checks, storage outside the web root, nothing executable. Uploads are a common route to remote code execution, the outcome GTIG sees in half of AI-found vulnerabilities.

Secrets and agent permissions. Which keys an agent holds, which daemons and sockets it can reach, which MCP servers it talks to. The MCP secrets and the Pillar escapes both come down to an agent holding more than its task needed.

When we build agents ourselves, the agent may draft any of these five, and a person writes or reads every line of them before it merges. It is slower on purpose. If you already run an agent with tools, scope its credentials to the task and run it somewhere it can't see your home directory.

AI generated code vulnerabilities are cheap to scan for, and sometimes that is enough

Most of the baseline costs nothing. The tools below catch the mechanical classes, such as leaked secrets, known-vulnerable dependencies and common injection patterns, and most free tiers cover a team of ten.

What scanners miss is logic: an IDOR, an endpoint nobody meant to expose, a row-level policy that allows slightly too much. Those are exactly the Lovable, Base44 and Moltbook bugs, and they mark the line between tier 2 and tier 3. For internal tools, scanners plus a second developer are a sensible floor. Customer-facing and regulated systems need a person whose job is to break the logic.

Vendor-published 2026 ranges for a single web application pentest run from about $5,000 to $30,000, with a simple app taking 3 to 7 testing days. Those come from firms that sell tests, so treat them as directional, and be wary of offers far below: the same source warns that cheap pentests are often scans with a nicer cover page. IBM's 2026 report puts the global average breach at $4.99M. A 15-person firm's breach costs far less than that enterprise average, so the comparison only holds for tier-4 systems, where it isn't close.

Cyber Resilience Act, GDPR and NIS2: your clients will ask about this next quarter

The regulatory clock moved this autumn. Since 11 September 2026, software manufacturers must report actively exploited vulnerabilities under the Cyber Resilience Act. Article 14 of the regulation sets the clock: an early warning within 24 hours, a notification within 72 hours and a final report no later than 14 days after a fix is available. The rest of the CRA applies from 11 December 2027, with fines up to €15M or 2.5% of worldwide turnover. NIS2 reaches further than its own scope: Article 21(2)(d) of the directive makes supply-chain security, including the relationship with each direct supplier, part of every in-scope entity's risk measures, so the security questionnaire reaches a 15-person vendor even when the vendor itself is out of scope.

An AI-written component doesn't change who the manufacturer is, and GDPR works the same way: Article 32 of the GDPR requires appropriate technical and organisational measures and a process for regularly testing them, and Article 33 gives you 72 hours to notify the authority of a breach. "The agent wrote that endpoint" is not a measure.

Where AI shapes decisions, the AI Act adds a layer, covered in EU AI Act compliance. What usually arrives first is a security questionnaire from a larger customer asking who reviews your code and what happens when a vulnerability lands. The blast-radius table answers the first part, the checklist below most of the rest.

Vibe coding security best practices: a Monday-morning checklist for small businesses

1. List everything that faces the internet. Any review of AI cybersecurity risks for small business starts from this list. Domains, VPNs, admin panels and self-hosted tools, especially automation and AI tooling: n8n, Langflow, Flowise, MinIO, anything spun up for a pilot. JadePuffer found its victims by scanning for exactly these.

2. Kill default credentials. minioadmin:minioadmin was the second step of a fully automated attack. Change every default login, and take admin panels off the public internet.

3. Write a patch SLA for internet-facing software. Decide how many days a critical patch on an exposed system may wait, and who applies it. Anything you can't patch, Windows 10 machines without extended updates included, goes behind a VPN or gets switched off.

4. Turn on phishing-resistant MFA. FIDO2 keys or passkeys for email, admin accounts and the code host first. ENISA's Threat Landscape 2025 still traces about 60% of initial access in the EU to phishing.

5. Get secrets out of code and agent configs, and dependencies the agent never verified. Run gitleaks or GitGuardian across every repository, MCP configuration files included, rotate whatever turns up, and switch on push protection. Before a package an agent added stays in the lockfile, check that it exists and is the one you meant.

6. Put a review gate on vibe-coded tools. Inventory every tool built on Lovable, Base44, Bolt or a coding agent, place each in a tier, and apply that tier's minimum before it touches real data.

7. Keep one offline backup and test the restore. JadePuffer's victims couldn't buy their data back. A copy that someone holding your admin credentials can't delete is the only answer to that.

Security belongs on the first line of the budget now

AI made attacks on old software cheaper, and it made new software faster to write than to check. Neither needs hype: the negative exploit window and the open Moltbook database are documented facts. The response is mostly unglamorous work a small team can start this week, with item 1 above. If a second pair of eyes on where your own tools sit in the tier table would help, our free audit covers that.

FAQ