Vibe Coding Tested: AI Agents Nail SQLi but Fail Miserably on Security Controls

Vibe coding, the use of AI to generate computer code, is gaining popularity but remains imperfect, as SecurityWeek reports. In tests conducted by Tenzai, five major AI coding agents—Anysphere Cursor, Claude Code, OpenAI Codex, Replit, and Cognition Devin—were used to build the same three apps from identical prompts, revealing a total of 69 vulnerabilities across 15 generated apps.

None of the apps contained an exploitable SQLi or XSS vulnerability, but the tests found serious issues elsewhere, including all five agents introducing an SSRF vulnerability and widespread problems with authorization when accessing APIs.

The researchers highlighted that security controls were frequently omitted or inadequately implemented, with statements that the agents “failed miserably when it came to security controls.” The article, dated 15 January 2026, cautions that vibe coding requires very detailed prompts and that untrained users may struggle to enforce rigorous security measures.