← BACK TO UPDATES
[01] / / 10 MIN READ

VIBE CODING SECURITY MONTHLY - AUG 5 - AUG 28, 2026

VIBE CODING SECURITY MONTHLY - AUG 5 - AUG 28, 2026
/ INSTANT SCAN

TEST YOUR APP NOW

Enter your deployed app URL to check for security vulnerabilities.

How to read this monthly

This digest is for founders, AppSec, and platform engineers who already ship with AI assistants. We prioritize measurable findings over vibes: named datasets, named benchmarks, and controls you can implement the same week. Every number below traces to a linked source; vendor-reported figures are labeled as such.

The July monthly was about the supply chain absorbing the AI era. August is about measurement: for the first time, four independent groups scanned or benchmarked AI-generated code at scale in the same month, and their numbers agree.

TL;DR - The month in one paragraph

  • Reeve scanned 30,998 live vibe-coded apps, Aug 12-14, published Aug 19. The State of Vibe-Coded App Security 2026: 99% had at least one finding (mostly missing security headers), 57% of reachable Supabase-backed apps (2,096 of 3,680) allowed unauthenticated table reads, 394 apps exposed people-named tables, 1,332 apps (1 in 23) shipped a secret, 13% published source maps, and 452 graded D or F.
  • Symbiotic Security: AI-assisted repos carry 4.4x more flaws, Aug 27. A three-month study of 1,967 GitHub repos plus 1,072 live vibe-coded apps across five platforms and ten scanners: 42.3 vulns per AI-assisted repo vs 9.6 human-only, 98% of vibe apps had at least one vuln, 29% high or critical, 16% allowed unauthenticated data delete or modify.
  • Academia converged. Understanding the (In)Security of Vibe-Coded Applications audited 200 deployed repos: 180 (90%) vulnerable, 1,471 vulns, Broken Access Control the top class at 36%. SUSVIBES (ICML 2026, revised in August) ran 186 real-world tasks across 12 agent setups: the best combination was 57% functionally correct but 11.8% secure, and 79.3% of correct solutions were still vulnerable.
  • The agents got weaponized. Gambit Security documented threat actors running Claude Code and OpenAI Codex as operational tooling; one campaign harvested 2,975 validated credentials from 1,742 hosts, including 661 SSH keys and 635 AWS keys. Pillar Security turned a hidden instruction in a GitHub issue into Editor-level access on an internal Google Cloud project via the Gemini CLI triage agent.
  • The platforms answered. Lovable’s CISO went on record about shared responsibility, and Gartner and Forrester told enterprises that hardcoded secrets pushed to GitHub is the #1 current vibe-coding risk.

What did Reeve’s 30,998-app scan actually find?

Between August 12 and 14, Reeve passively scanned 30,998 live, deployed vibe-coded web apps - no exploitation, just what any anonymous visitor could observe. Results published August 19.

The headline 99% had at least one finding is less alarming than it sounds: most findings were missing security headers, which is the same baseline hygiene gap you find on human-built sites. The numbers that matter are the ones a real attacker would monetize:

  • 57% of reachable Supabase-backed apps (2,096 of 3,680) allowed unauthenticated table reads. That is RLS off or misconfigured on the majority of a platform the vibe-coding stack has standardized on.
  • 394 apps exposed tables named after people - users, customers, members, patients. Those are personal-data breaches waiting for a disclosure email.
  • 1,332 apps (1 in 23) shipped a secret in a public bundle or config.
  • 13% published source maps, handing over readable original source to anyone who asks for the .map file.
  • 452 apps graded D or F on Reeve’s composite scale.

Why it matters: this is the first passive scan at this scale where the methodology is public and the population is live production apps, not GitHub samples. It also confirms the gap between what platforms say they check and what ships. Lovable’s CISO said in the same month that the platform scans every app and shipped auto-fix in June - and yet over half the reachable Supabase backends were open.

What to do: the three checks Reeve ran are the three you can run on yourself in under ten minutes. Test anonymous reads against your Supabase tables with our Supabase RLS checker, scan your deployed bundle for keys with the token leak checker, and confirm you are not serving .map files with the source map checker. Then fix headers last - they are the cheapest and the least dangerous.

Is AI-assisted code really 4.4x worse?

On August 27, Symbiotic Security published a three-month study covering 1,967 public GitHub repos and 1,072 live vibe-coded apps across five platforms, cross-checked with ten independent scanners, for 87,826 vulnerabilities total.

The comparison: AI-assisted repos averaged 42.3 vulnerabilities vs 9.6 for human-only - the 4.4x figure. 70.5% of AI-assisted repos had at least one issue vs 50.4% of human ones. On the live vibe-app side, 98% had at least one vuln, 29% high or critical, and 16% allowed unauthenticated data delete or modify - not just read.

The 16% number matters more than the 57%. Reeve found 57% of Supabase apps readable; Symbiotic found roughly one in six apps writable by an anonymous caller. A readable table is a privacy incident. A writable one is data destruction, ransom, or a defacement.

Caveats that Symbiotic’s own framing invites: “AI-assisted” is inferred from commit signals and repo metadata, and vulnerability counts from ten scanners will include overlap and false positives. The direction is consistent with everything else this month; the exact multiplier is softer than the headline.

The same week, BankInfoSecurity covered CodeRabbit-related PR data pointing the same way: AI-generated PRs carry ~11 issues vs ~6 for human PRs, with the security classes skewing worst - improper password handling +88%, insecure object references +91%, XSS nearly 3x, insecure deserialization +82%.

What to do: stop arguing about the multiplier and instrument your own. Tag PRs by AI involvement (most teams already can via commit trailers or the assistant’s own metadata) and track findings-per-PR by class. If your insecure-object-reference rate on AI PRs is anywhere near +91%, that is a BOLA test gate, not a code review problem. Our common security flaws page has the test shapes for each class.

What do the two academic audits add?

Two arXiv papers landed or were revised in the same week, and they agree with the scanners from a different angle.

Understanding the (In)Security of Vibe-Coded Applications (HTML dated Aug 24) is the first large-scale audit of deployed vibe-coded repositories rather than synthetic tasks: 200 repos, 180 (90%) with at least one vuln, 1,471 vulns total, median 7 and mean 8.1 per vulnerable repo. Severity: 20% critical, 56.7% high. Class breakdown: Broken Access Control 530 findings (36%), touching 75.5% of repos; cryptographic failures in 63% of repos; injection in 61.5%.

The paper’s root-cause taxonomy attributes the recurring patterns - placeholder logic that never got replaced, unfiltered input, secrets in source - to three defect types in the generating agent: memory (the agent forgets constraints from earlier in the session), objective (it optimizes for passing the visible test), and knowledge (it does not know the secure idiom for the framework). That maps directly onto what you can fix in a prompt versus what needs a gate.

SUSVIBES (Zhao et al., LeiLiLab, ICML 2026, v3 revised mid-to-late August; repo) is the benchmark side: 186 repo-level tasks taken from real projects where humans previously shipped a vulnerability, spanning 79 CWE categories, run against 12 agentic settings (SWE-Agent, OpenHands, Claude Code; Claude 4 Sonnet, Gemini, Kimi). The best combination, SWE-Agent with Claude 4 Sonnet, was 57% functionally correct but only 11.8% secure. 79.3% of functionally correct solutions were still vulnerable. Adding explicit vulnerability hints to the prompt did not fix it. Cryptonomist’s coverage is the accessible summary.

Two smaller results round it out. Darko Andročec’s twin-prompt study (arXiv:2608.20963, Aug 21) generated six web apps twice, baseline vs a security-appended prompt: 51 confirmed findings baseline vs 24 security-aware, with no Critical or High in the security-aware set - a small non-iterative corpus, but a clean demonstration that the prompt moves the floor. And DevOps.com reported an OWASP Top 10 comparison where no model was universally best: GPT 5.1 scored 79.6, Gemini 2.5 Pro 73.5, Sonnet 4.5 71.2, Haiku 4.5 49.5 - and security varied more by language and framework than by model. Cost did not buy security.

What to do: read the 11.8% and the +91% together. The agent will pass your tests and skip your authorization. Write the authorization test before the agent starts (owner reads, stranger gets 403, anonymous gets 401) and let it fail red until the agent earns green. Security-appended prompts help - Andročec’s result is real - but SUSVIBES says hints alone do not close the gap on real repos.

The agents as weapons: Claude Code, Codex, and Gemini CLI

Two stories this month were not about insecure output but about the coding agents themselves as attack tooling or attack surface.

On August 18, Gambit Security via GBHackers described threat actors using Claude Code and OpenAI Codex as operational tools - ransomware preparation, reconnaissance, firewall changes, and large-scale credential harvesting. One campaign, April 5 to May 23, collected 2,975 validated credentials from 1,742 hosts: 661 SSH keys, 635 AWS keys, 448 Gemini API keys, and more. The population being harvested is, in large part, the same population Reeve and Symbiotic scanned: apps with secrets in bundles and open storage.

On August 28, Pillar Security via DevOps.com disclosed a prompt-injection path against Google’s Gemini CLI: hidden instructions inside a GitHub issue, processed by an automated triage agent, caused the agent to issue Workload Identity Federation credentials that granted Editor-level access to an internal Google Cloud sandbox project. The issue text was the payload; the agent’s own cloud permissions were the blast radius.

At Black Hat USA, TechTarget reported the consensus that human-in-the-loop does not scale for agentic development, citing a Gartner projection of Fortune 500 agent counts going from under 15 in 2025 to over 150,000 by 2028. That is the volume at which a GitHub issue becomes an exploit surface.

What to do: treat any agent that reads untrusted text (issues, PR descriptions, web pages, package READMEs) and holds cloud credentials as a confused-deputy risk. Scope its identity to the minimum project and role, deny credential issuance from automated contexts, and log every tool call. Our agent skills are attack surface piece covers the same failure shape from the plugin side, and /agentic-coding-security/ has the per-tool hardening notes.

What the platforms and analysts said

Lovable’s CISO Igor Andriushchenko sat down with Resilient Cyber on August 25 and laid out the platform’s model: soft versus hard guardrails, an auto-fix toggle shipped in June 2026, per-app threat models, scanning of every app, and a stated goal of shipping apps for citizen developers “with no security tab” at all. The interview is the most candid platform-side statement of shared responsibility to date. Read it against Reeve’s 57% and the gap is the story - platform scanning exists, and most Supabase backends were still open the same month. Our Lovable June report traced how auto-fix landed; the August data shows how far it has yet to reach.

Gartner and Forrester, via Computerworld on August 17, framed vibe coding as a top enterprise risk with hardcoded secrets pushed to GitHub as the #1 current issue, followed by unscanned citizen-developer apps, expanded attack surface, and IP and data leakage. Nothing new to anyone reading this digest, but a useful citation when you need budget.

Early in the month, WIRED (Aug 5, via Freevacy) covered a Red Access study of 5,000+ AI-built web apps with little or no authentication, roughly 40% (about 2,000) leaking sensitive data - medical, financial, strategy documents, chatbot transcripts - across Lovable, Replit, Base44, and Netlify, plus phishing sites impersonating major brands hosted on the same platforms. Reeve’s larger scan two weeks later put a tighter number on the same population.

The Survey of Vibe Coding with Large Language Models (ICT CAS and collaborators) is worth a skim for vocabulary: it formalizes vibe coding as a constrained MDP and names five development models - UAM, ICCM, PDM, TDM, CEM - with unconstrained automation (UAM) ranked lowest on security and highest on technical-debt risk. If you need a way to describe “we let the agent run with no gates” to a board, that is the term.

Why this month’s numbers rhyme

Line them up:

Source Population Any vuln Access-control finding
Reeve 30,998 live apps 99% 57% of Supabase apps readable anonymously
Symbiotic 1,072 live apps 98% 16% writable anonymously
arXiv 2606.23130 200 deployed repos 90% BAC 36% of findings, 75.5% of repos
SUSVIBES 186 tasks x 12 agents 88.2% of best-case solutions -
Red Access / WIRED 5,000+ apps - ~40% leaking data

Four methodologies - passive scanning, multi-scanner SAST, manual audit, benchmark - and they converge on the same two facts. Almost everything AI-generated has something wrong with it, and the thing most likely to be badly wrong is access control. Not injection, not crypto, not headers. The agent builds the feature, wires the database, and does not ask who is allowed to call it.

The arXiv paper’s taxonomy explains why. Access control is a memory and objective defect, not a knowledge defect. The model knows what RLS is. It forgets that the table it created in turn 3 needs a policy by turn 40, and its objective - the test you gave it - never checked. That is why Andročec’s security-appended prompt helped (it refreshes memory) and why SUSVIBES’ vulnerability hints did not close the gap on large repos (memory decays over a long context regardless of the hint).

What this means for Lovable/Bolt/Cursor apps specifically

  • Supabase is the default backend and RLS is the default gap. 57% is not a tail risk. Assume yours is open until the anonymous-read test says otherwise.
  • Writes are on the table. 16% writable means “delete all rows” is a curl away for one in six apps. Test DELETE and PATCH as an anonymous caller, not just GET.
  • Secrets ship at 1-in-23. The VITE_ and NEXT_PUBLIC_ prefixes are the usual route. Run a bundle scan on every deploy, not once.
  • Source maps are on at 13%. Turn sourcemap off in production builds or serve maps only to authenticated error-tracking.
  • The agent in your CI reads your issues. If a Gemini CLI, Claude Code, or Codex step processes issue or PR text and holds cloud credentials, it is a Pillar-class target. Scope it down this week.

Metrics to track inside your org (post-August)

  • Anonymous-read and anonymous-write pass rate across all tables, per deploy
  • Findings per PR, split by AI-assisted vs human, by OWASP class
  • Secrets caught pre-merge vs in production bundles
  • Agent tool-call log coverage: what fraction of agent runs have a full audit trail
  • Cloud roles held by automated agents, and the last date each was reviewed

Manual checklist - 10 things to verify yourself

  1. Hit your Supabase REST endpoint with only the anon key and confirm every table returns 401 or an empty set
  2. Repeat with DELETE and PATCH verbs against a known row ID
  3. Grep your production bundle for sk_, AKIA, service_role, and your own API key prefixes
  4. Request /assets/*.js.map on production and confirm 404
  5. List every table whose name is a noun for people and confirm each has an RLS policy with a USING clause
  6. Find every CI job that runs a coding agent and list the credentials it can reach
  7. Confirm no automated agent can mint or exchange cloud tokens without a human step
  8. Tag last month’s PRs by AI involvement and count security findings per class
  9. Write the owner-vs-stranger authorization test for your top three resources before the next agent session
  10. Check the headers last: HSTS, CSP, X-Frame-Options, and CORS origin list

Sources

This digest is compiled from 18 public sources dated August 5-28, 2026. Scan and benchmark figures are as reported by each source; we have not independently reproduced them. Symbiotic Security’s 4.4x figure and the CodeRabbit-related PR statistics depend on how “AI-assisted” was inferred and should be read as directional.

/ MORE UPDATES

Keep reading

/ NEXT STEP

YOU ARE PROBABLY IN THE 99%

Reeve found at least one issue in 99% of 30,998 live vibe-coded apps. Run the same class of passive checks on yours before someone else does.

14-day free trial · No credit card · Cancel anytime

START FREE SCAN →
/ GOOGLE SEARCH

See VibeEval more often in Google Top Stories.