Artificial intelligence can now generate working software in seconds. But growing research shows that a significant portion of AI generated code contains security vulnerabilities. As “vibe coding” becomes more common in classrooms and industry, educators and students need to understand the risks as well as the opportunities.
What is Vibe coding?
Artificial intelligence is rapidly transforming how software is created. Modern AI coding assistants allow users to describe a task in natural language and receive working code almost instantly. Instead of writing programs line by line, developers can simply explain what they want and allow the AI to generate the solution.
This workflow is increasingly referred to as “vibe coding”, a term used to describe programming where developers rely on AI systems to generate software through prompts and iteration.
The productivity gains can be significant. AI tools can help beginners build applications quickly and allow experienced developers to prototype ideas in minutes rather than days. However, this speed can come at a cost. From a cybersecurity perspective, vibe coding introduces several risks that developers and educators should understand.
AI can generate working software in seconds. Security vulnerabilities can appear just as quickly.
When developers do not fully understand the code
Traditional software development requires programmers to understand how each part of their system works. With AI generated code, that understanding can be reduced. Developers may receive large blocks of functioning code without fully knowing how it operates.
This creates a potential security problem. If developers cannot easily explain how their code works, they may struggle to identify vulnerabilities or recognise unsafe programming practices.
Research has shown that developers using AI coding assistants often express greater confidence in the security of the generated code, even when vulnerabilities are present. This combination of high trust and reduced scrutiny increases the likelihood that insecure software may be deployed.
Evidence shows AI generated code often contains vulnerabilities
Empirical evidence increasingly supports these concerns.
A large scale study analysing public GitHub repositories examined 7,703 files generated by AI coding tools including ChatGPT and GitHub Copilot. Using automated security analysis, researchers discovered 4,241 instances of known software vulnerabilities across 77 different categories.
These vulnerabilities included issues such as insecure randomness, cross site scripting risks and unsafe code execution.
Other research has produced similar findings. One empirical study analysing AI generated code snippets found that 29.5 percent of Python code and 24.2 percent of JavaScript code contained security weaknesses, many of which matched the industry’s Top 25 most dangerous software vulnerabilities.
Large scale evaluations of AI models used for programming have also found that more than 60 percent of generated programs contained detectable vulnerabilities, highlighting how common insecure patterns can be in machine generated code.
Industry research echoes these findings. A 2025 analysis of large language models performing programming tasks reported that around 45 percent of AI generated code contained security flaws, even when the output appeared ready to deploy.
Insecure coding patterns can appear in nearly half of AI generated programs.
Iterative prompting can introduce new risks
Another characteristic of vibe coding is the use of repeated prompts to refine code. Developers often ask the AI to modify or extend previously generated code until the program behaves as expected.
However, research suggests this iterative process can gradually introduce new vulnerabilities.
A controlled study examining iterative AI code generation found that after several rounds of revisions, the number of critical vulnerabilities increased by 37.6 percent compared with the original version of the code. Because each new prompt builds on earlier AI generated outputs, insecure patterns can accumulate without being detected.
Faster development can also mean more vulnerabilities
Beyond individual vulnerabilities, AI assisted development can increase the overall number of security issues entering software projects.
Research examining development workflows found that while AI tools allow developers to produce three to four times more code, they can also introduce up to ten times more potential security vulnerabilities, including exposed credentials, insecure dependencies and configuration errors.
This means that while productivity increases, the volume of potential security weaknesses may also grow.
AI can dramatically accelerate software development. But without proper security checks, it can also accelerate risk.
What this means for education
For educators working with students interested in computing and cybersecurity, vibe coding presents both opportunities and challenges.
AI coding tools can make programming more accessible. Students can experiment with software development earlier and build complex projects more quickly. Furthermore, with the increasing democratisation of software development amongst non traditional programmers, we’ll no doubt see a plethora of new and innovative apps and tools being distributed. At the same time, these tools highlight why secure coding practices remain essential.
Students should be encouraged to treat AI generated code as a starting point rather than a finished product. Code review, vulnerability scanning and secure design principles remain fundamental skills that every developer needs to learn.
Looking Ahead
The encouraging news is that the technology is improving rapidly. AI tools are becoming better at identifying insecure code patterns and assisting developers with secure programming practices. As these systems evolve, they have the potential not only to accelerate development but also to help build safer and more resilient software.
Used responsibly, AI assisted coding could empower a new generation of developers to create innovative applications and tools that improve everyday life. For students learning cybersecurity today, understanding both the risks and the possibilities will be key to shaping a safer digital future.
Become a CyberFirst School
If you’re a school or college in Wales and want to enjoy the benefit of CyberFirst, there’s no better time than the New Year to start your award application.
