{"id":24794,"date":"2025-10-10T12:32:29","date_gmt":"2025-10-10T16:32:29","guid":{"rendered":"https:\/\/me-en.kaspersky.com\/blog\/vibe-coding-2025-risks\/24794\/"},"modified":"2025-10-28T16:13:35","modified_gmt":"2025-10-28T12:13:35","slug":"vibe-coding-2025-risks","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/vibe-coding-2025-risks\/24794\/","title":{"rendered":"The hidden dangers of AI coding"},"content":{"rendered":"

Although the benefits of AI assistants in the workplace remain debatable<\/a>, where they\u2019re being adopted most confidently of all is in software development. Here, LLMs play many roles \u2014 from refactoring and documentation, to building whole applications. However, traditional information security problems in development are now compounded by the unique vulnerabilities of AI models. At this intersection, new bugs and issues emerge almost weekly.<\/p>\n

Vulnerable AI-generated code<\/h2>\n

When an LLM generates code, it may include bugs or security flaws. After all, these models are trained on publicly available data from the internet \u2014 including thousands of examples of low-quality code. A recent Veracode study<\/a> found that leading AI models now produce code that compiles successfully 90% of the time. Less than two years ago, this figure was less than 20%. However, the security of that code has not improved \u2014 45% still contains classic vulnerabilities from the OWASP Top-10 list<\/a>, with little change in the last two years. The study covered over a hundred popular LLMs and code fragments in Java, Python, C#, and JavaScript. Thus, regardless of whether the LLM is used for \u201ccode completion\u201d in Windsurf or \u201cvibe coding<\/a>\u201d in Loveable, the final application must undergo thorough vulnerability testing. But in practice this rarely happens: according to a Wiz study<\/a>, 20% of vibe-coded apps have serious vulnerabilities or configuration errors.<\/p>\n

As an example of such flaws, the case of the women-only dating app, Tea, is often used, which became notorious after two major data leaks<\/a>. However, this app predates vibe coding. Whether AI was to blame for Tea\u2019s slip-up will be determined in court<\/a>. In the case of the startup Enrichlead, though, AI was definitely the culprit. Its founder boasted<\/a> on social media that 100% of his platform\u2019s code was written by Cursor AI, with \u201czero hand-written code\u201d. Just days after its launch, it was found to be full of newbie-level \u00a0security flaws<\/a> \u2014 allowing anyone to access paid features or alter data. The project was shut down after the founder failed to bring the code up to an acceptable security standard using Cursor. However, he remains undeterred and has since started new vibe-coding-based projects.<\/p>\n

Common vulnerabilities in AI-generated code<\/h2>\n

Although AI-assisted programming has only existed for a year or two, there\u2019s already enough data to identify its most common mistakes<\/a>. Typically, these are:<\/p>\n