AI Vibe Coding: Security Risks & Vulnerabilities Exposed

A recent software supply chain attack on Axios, a widely used programming library, highlights the growing security risks associated with AI-assisted software development, also known as ‘vibe coding’. Attackers compromised a trusted maintainer account on March 31, 2026, injecting malicious code into Axios updates, which then spread malware to developers who installed the compromised updates.

This breach, though brief, demonstrates how a single compromised dependency can endanger numerous applications without directly affecting their code. As AI becomes more integrated into software development, the potential for manipulating AI behavior introduces new security challenges.

Vibe coding, while reducing workloads, can lead to severe security vulnerabilities due to untrained users or AI models prioritizing speed over security. Experts estimate that 60-65% of vibe code systems are susceptible to attacks and breaches. One significant threat is prompt injection, where hackers alter code through AI tool queries, influencing AI systems that generate applications.

Rahul Poruri, CEO of FOSS United, noted the commonality of prompt injection, with phrases like ‘ignore previous instructions’ appearing even on professional platforms. This creates a challenge where vulnerabilities exist as influence rather than detectable code.

Abhishek Datta, founder of Safedep, describes this as a parallel supply chain, with components from open-source ecosystems being included in application code or AI agent harnesses. These dependencies, which are relatively new, carry supply chain risks but face less scrutiny and fewer security controls.

The removal of human oversight in dependency decisions is another concern. AI coding agents can autonomously select and install packages without human review, eliminating a traditional checkpoint where developers might notice anomalies. Attackers are already adapting by registering package names that match patterns generated by language models, a tactic Datta refers to as ‘AI-driven typosquatting’.

Vaibhav Tare, CISO at Fulcrum Digital, added that developers often trust syntactically correct outputs, which may include insecure logic or hidden vulnerabilities. These vulnerabilities are increasingly visible in early vibe-coded applications, where speed and abstraction often come at the expense of deep understanding and foundational security knowledge.

Siddon Tang, general manager of Asia Pacific at TiDB, pointed out that India’s large and rapidly growing software developer base, estimated at 4.3 to 5.8 million, creates a wider, harder-to-audit attack surface. Biswajeet Mahapatra, principal analyst at Forrester, estimates that vibe coding-related vulnerabilities could account for 20 to 30% of application security incidents.

Currently, the AI industry is more focused on adoption growth than on addressing potential future attacks. Developers in India, who heavily rely on community-driven platforms and tutorials, may inadvertently introduce vulnerabilities through AI-generated code lacking validation. This increases the exposure to AI-powered cybersecurity incidents.

To mitigate these risks, AI coding platforms need to implement guardrails and re-educate developers to address these compounding effects, ensuring that security is a priority in the rapidly evolving landscape of AI-assisted software development.