Veracode Study Reveals AI Code Security Flaws

The Era of Vibe Coding

AI-driven “vibe coding” tools promise to accelerate development by generating code from natural language prompts. But a new report from Veracode delivers a stark warning: these vibes can mask serious security gaps that could expose applications to hacks and data breaches.

Half of AI-Generated Code is Insecure

Veracode tested over 100 large language models on 80 coding tasks, each with known vulnerabilities. Only 55% of AI-generated solutions passed security checks—leaving 45% riddled with OWASP Top 10 defects that demand immediate attention.

• Broken access control allowing unauthorized actions
• Cryptographic failures risking data exposure
• Data integrity failures that undermine trust

Security Plateau Raises Alarms

While syntax errors have dropped—LLMs now produce compilable code nearly every time—the security quality hasn’t budged in two years. Larger, newer models still struggle with the same critical flaws, even as enterprises rush to integrate AI into development workflows.

Threats on the Rise

This month, a hacker exploited Amazon’s AI coding agent by injecting malicious instructions into its GitHub repo, causing file deletions on user machines. Simultaneously, UC Berkeley research shows AI tools are excelling at spotting and exploiting such vulnerabilities in code.

Mitigating AI Code Risks

Organizations must evolve their security strategies to include AI-aware testing and continuous code analysis. QuarkyByte’s approach blends automated vulnerability scanning with expert-driven code reviews, ensuring AI-assisted projects meet high security standards before deployment.