Vibe Coding and the Security Debt Crisis

Abstract

“Vibe coding” is building software by describing it to an AI model and accepting the result without reading the code. Since the practice was named in February 2025 it has moved from weekend experiments to products that hold real customer data. This paper reviews the empirical security evidence on AI-generated code from 2022 to October 2026 — controlled studies, vendor benchmarks, repository telemetry and documented production incidents. Models now write code that compiles and runs almost every time, but security has lagged: in Veracode's benchmark the share of AI-generated samples passing security checks rose only from 55% (2025) to 62% (October 2026), still leaving 38% of tasks vulnerable, and users of AI assistants in a controlled Stanford study wrote less secure code while feeling more confident in it. In production the failures are rarely exotic: missing database access rules, identifiers mistaken for credentials, over-privileged agents, and instructions treated as security controls. The paper organises these failures into a taxonomy, examines documented cases, traces six root causes, and proposes VIBE-SAFE — a five-layer defence-in-depth framework that moves enforcement out of the prompt and into deterministic controls — together with a pre-launch checklist for builders.

Introduction

The phrase “vibe coding” — fully giving in to the vibes and forgetting the code exists — spread quickly in 2025 and was named Collins Dictionary's Word of the Year. By 2026 a distinction had emerged between vibe coding, which raises the floor for people who could not previously build software, and agentic engineering, in which engineers direct AI agents while keeping responsibility for specification, review, evaluation and security.

The security problem appears when the first practice is used where the second is required: an unreviewed prototype is put in front of real users and real data. Security debt — unresolved weaknesses accumulating faster than they are found and fixed — grows because AI produces more code per unit time and each unit receives less human attention.

Scope & evidence standard

This is a structured narrative review covering January 2022 to 31 October 2026, drawing on peer-reviewed venues (IEEE S&P, ACM CCS, USENIX Security, COLM, arXiv), industry telemetry, vulnerability registries, researcher disclosures and incident databases. It is explicitly not a PRISMA-style systematic review.

Every claim is graded: A — peer-reviewed study or primary registry record; B — vendor benchmark or telemetry with a published method; C — researcher disclosure or credible press report, stated as “reported”. Unsourced or untraceable statistics were excluded, including several widely repeated figures.

What the evidence shows

Controlled studies show assistants change both outcomes and confidence: in a 47-participant study, assistant users produced less secure solutions on four of five tasks (for encryption, 21% secure versus 43% for the control group). Earlier work found about 40% of 1,689 Copilot-generated programs contained vulnerabilities.

Benchmarks show capability rising faster than security: functional pass rates are near-perfect while security pass rates moved from 55% to 62% across 2025–2026, with cross-site scripting and log injection barely improving.

Case studies

The paper examines documented incidents including missing row-level security on prompt-to-app platforms (CVE-2025-48757), an authentication bypass where a public identifier acted as a credential, an AI agent that deleted a production database during an explicit code freeze, unsafe-by-default repository opening in coding agents, and agent-targeted supply-chain events. Each case separates what is established from what is only reported, and identifies the deterministic control that would have stopped it.

The VIBE-SAFE framework

If a prompt is an expression of intent and not a control, security has to be enforced outside the model. VIBE-SAFE organises that enforcement into five layers:

L1 Context & generation — persistent project security rules, approved libraries and query patterns, every dependency checked against the live registry and lockfile, no secrets in prompts.

L2 Agent containment & MCP governance — no parsing of project config, hooks or MCP servers before explicit trust; server allowlists; per-tool authorisation; task-scoped short-lived tokens; read-only database roles by default.

L3 Automated build-time gates — SAST on every pull request, dependency and malware scanning, secret scanning with pre-commit hooks, DAST on staging, SBOM and provenance for releases.

L4 Secure-by-default platforms — RLS on every new table, deny-by-default storage, separated environments with no agent route to production, an SQL proxy that rejects destructive statements, immutable audit logs.

L5 Accountability & governance — a named human owner for every machine and agent identity, scheduled access reviews, decommissioning, and incident-reporting readiness.

VIBE-SAFE is a synthesis of established controls; its combined effectiveness has not been empirically tested, and the paper says so.

Limitations

Not a systematic review; vendor-heavy evidence cited with attribution but not reproduced; task-level benchmarks don't capture long-horizon agent behaviour; public incidents over-represent high-visibility failures; AI involvement in some incidents is not independently established; and the facts move quickly — statements reflect sources available on 31 October 2026.

Conclusion

Vibe coding has lowered the cost of building software to near zero and left the cost of securing it where it was. The practical rule is short: a prompt expresses intent; it is never a security control. Use AI to write code faster, but put enforcement where it cannot be argued with — and keep a human responsible for what ships.