Is vibe-coded software safe to ship?
Short answer
Not without review: in a 2021 arXiv study, Pearce and colleagues found about 40% of 1,689 programs written by GitHub Copilot to be vulnerable.
Treat generated code like code from a new contributor. Check six things before release: secrets in the code, input passed to SQL, shells or the page, dependencies that do not exist, known weak patterns, licence notices on copied blocks, and your own overconfidence. Each takes minutes; a scanner helps but does not replace reading.
The flaws that recur
- 40% Of 1,689 programs Copilot produced for 89 scenarios built around high-risk weaknesses were vulnerable, in a 2021 study. Pearce et al., arXiv 2108.09293
- Injection Model output passed to a shell, eval, the browser or unparameterised SQL gives code execution, XSS or SQL injection. OWASP LLM05:2025
- Fake packages Models recommend dependency names that do not exist, which anyone can register. Spracklen et al., arXiv 2406.10279
What did the research find about AI-written code security?
Three studies set the baseline, and they agree on the direction. In the 2021 arXiv paper Asleep at the Keyboard?, Pearce, Ahmad, Tan, Dolan-Gavitt and Karri prompted GitHub Copilot with 89 scenarios built around high-risk weakness types from MITRE's Top 25 list. Copilot produced 1,689 programs, and the authors found approximately 40% of them vulnerable.
The second study looked at people rather than the model. In Do Users Write More Insecure Code with AI Assistants?, Perry and colleagues found that participants with an assistant wrote significantly less secure code than those without one, and were more likely to believe their code was secure.
The third source is a vendor report, so read it as the vendor's own claim. Veracode's GenAI Code Security Report page says it analysed code from over 100 large language models across Java, JavaScript, Python and C#, and that AI-generated code introduced risky security flaws in 45% of tests. Veracode sells code scanners, and the page gives no method details, so CodeLifter treats the 45% figure as vendor-attributed.
None of this makes generated code uniquely dangerous; human code has the same flaws. What changes with vibe coding is that nobody reads the code, so the usual chance of catching a flaw in review disappears.
How do I find secrets and API keys in generated code?
Search before you commit. Assistants often write a working example with a key pasted inline, and people often paste their own key into a prompt to make the example run. GitHub's secret scanning documentation says the feature scans the entire Git history on all branches for hardcoded credentials, and runs automatically for free on public repositories.
The same page gives the order of operations when a key leaks: rotate the affected credential immediately. Removing the secret from Git history is time-intensive and often unnecessary once the credential is revoked. Deleting the line in a new commit does nothing for the old commit.
How should generated code handle user input?
Treat anything that reaches a database, a shell or a web page as hostile, including text a model wrote. The OWASP GenAI Security Project's entry LLM05:2025 Improper Output Handling lists what goes wrong: output entered into a shell or eval gives remote code execution, generated JavaScript or Markdown rendered in a browser gives cross-site scripting, and generated SQL run without parameterisation gives SQL injection.
Its mitigations are to treat the model as any other user, encode output for its context, and use parameterised queries for every database call. On a small web page, the most common form of the problem is one line: a script that writes user text into the page with innerHTML where textContent would do.
What are hallucinated packages, and why do they matter?
A hallucinated package is a dependency the model named but nobody published. Spracklen and colleagues generated 576,000 code samples with 16 models and found hallucination rates of at least 5.2% for commercial models and 21.7% for open-source models, with 205,474 unique invented names. An attacker can publish malware under a name models tend to invent and wait.
OWASP's sixth attack scenario for LLM05 makes the same point. Before installing any dependency you did not choose yourself, look it up on its registry: confirm the exact name, the publisher, the first release date and whether anything depends on it.
A ten-minute review routine for generated code
Read the diff top to bottom and delete anything you cannot explain. Search it for keys, tokens and connection strings and move them to environment variables. List every new import and look each one up. Find every place input reaches SQL, a shell, eval, innerHTML or a file path, and fix it with parameters, textContent or allow-lists.
Run a static analyser and a dependency audit and read the findings. Search distinctive lines for public matches and keep any licence notice you find. Check the permissions the code and its setup steps ask for. Write down which assistant you used and what you changed. This routine does not replace a professional audit for anything that handles money, health data or many users.
A scanner finds patterns; it does not know what your code was meant to do, so someone still has to read it.
How we checked
Checked on 2026-10-15 by the CodeLifter editors: the arXiv abstract pages for papers 2108.09293, 2211.03622 and 2406.10279, the OWASP page for LLM05:2025, GitHub's secret scanning documentation and Veracode's GenAI Code Security Report page. Veracode's 45% figure is reported as the vendor's own claim because its page publishes no method. CodeLifter has not run its own security test of generated code; the routine is the editors' synthesis of the sources. Drafted with AI assistance; every claim checked against its source.
Questions and answers
Is AI-generated code secure?
Not by default. In a 2021 arXiv study, Pearce and colleagues found about 40% of 1,689 programs generated by GitHub Copilot were vulnerable. Generated code needs the same review as human code.
Do developers write less secure code with AI assistants?
One study says yes. In a 2022 user study, Perry and colleagues found participants with an assistant wrote significantly less secure code and were more likely to believe it was secure.
What is package hallucination?
A code model recommending a dependency that does not exist. A 2024 study of 576,000 samples found average rates of at least 5.2% for commercial models and 21.7% for open-source models.
What should I do if an assistant put my API key in committed code?
Rotate the key immediately. GitHub's secret scanning documentation says to rotate the affected credential first, and that removing it from history is often unnecessary once it is revoked.
Does OWASP have guidance on AI-generated code?
Yes. The OWASP GenAI Security Project's LLM05:2025 Improper Output Handling entry covers model output reaching shells, browsers and databases, and warns about hallucinated packages.
Can a security scanner replace reading the code?
No. Scanners catch known patterns and vulnerable versions. Logic flaws, excess permissions and missing access checks still need a person who reads the code.
Is Veracode's 45% figure reliable?
Treat it as a vendor claim. The report page says AI-generated code introduced risky flaws in 45% of tests across over 100 models, but publishes no method, and Veracode sells scanning products.
Sources
An editor checked every claim on this page against these sources on 2026-10-15. If a source has changed since, the source is the authority.
