Declared
CVE growth in AI-generated code
CVE entries attributed to AI-generated code rose from 6 in January 2026 to more than 35 in March 2026.
2026-03
Mixed · 2026-04
First-quarter 2026 assessment of 200 apps
183 of 200 vibe-coded apps, 91.5 percent, contained at least one vulnerability traceable to AI hallucination or missing security context.
Last updated 2026-04
Not verified
What the sources report
The sources report 183 of 200 apps containing at least one vulnerability.
That is 91.5 percent.
The vulnerabilities are traced to AI hallucination or missing security context.
Root cause class
Study
Covered by
What ShipReady can say
Most of what this study counts sits behind the app. That is the not-verified list, named item by item rather than left out.
Sources
Related incidents
- Observed
5,600 vibe-coded apps scanned
More than 2,000 vulnerabilities and more than 400 exposed secrets found across vibe-coded apps.
2026-02 - Not verified
Tenzai study of AI-built apps
69 vulnerabilities across 15 apps built by five AI coding tools.
2026-02
Check your app
Run all sixteen groups on your published address and see the evidence behind every result.
ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.
Last updated September 20, 2026