Not verified
First-quarter 2026 assessment of 200 apps
183 of 200 vibe-coded apps, 91.5 percent, contained at least one vulnerability traceable to AI hallucination or missing security context.
2026-04
Five AI coding tools · 2026-02
Tenzai study of AI-built apps
69 vulnerabilities across 15 apps built by five AI coding tools.
Last updated 2026-02
Not verified
What the sources report
The sources report 69 vulnerabilities across 15 apps.
The apps were built by five AI coding tools.
Every app lacked CSRF protection.
Every tool introduced SSRF.
Root cause class
Study
Covered by
What ShipReady can say
Cross-site request forgery and server-side request forgery live in request handling. They stay Not verified until a review reads the code.
Sources
Related incidents
- Declared
CVE growth in AI-generated code
CVE entries attributed to AI-generated code rose from 6 in January 2026 to more than 35 in March 2026.
2026-03 - Observed
5,600 vibe-coded apps scanned
More than 2,000 vulnerabilities and more than 400 exposed secrets found across vibe-coded apps.
2026-02
Check your app
Run all sixteen groups on your published address and see the evidence behind every result.
ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.
Last updated September 20, 2026