Triaging Vulnerabilities in Vibe-Coded Projects: Severity, Exploitability, and Impact

You hit 'generate,' the code appears, and it works. Or does it? In the world of vibe coding, where developers instruct large language models (LLMs) to build applications through high-level prompts rather than line-by-line specifications, speed is the headline feature. But security is the silent killer. As development velocity skyrockets, so does the volume of hidden vulnerabilities. The question isn't whether your AI-generated code has bugs-it's how quickly you can find them before they are exploited.

Traditional software security triage assumed human intent behind every line of code. Vibe coding breaks that assumption. When an LLM generates a function, it doesn't "know" it's insecure; it simply predicts the next most likely token based on training data that includes millions of insecure code snippets. This fundamental shift requires a new approach to triaging vulnerabilities, focusing heavily on severity, exploitability, and impact specific to AI-generated artifacts.

The Reality of AI-Generated Code: It Fails Security Tests

Let’s look at the numbers because they are startling. Research published in December 2025 introduced the SusVibes benchmark, a comprehensive test suite designed specifically for AI agents. The results were sobering: frontier LLMs failed over 80% of security tests, even though they passed more than 50% of functional tests. This benchmark covered 200 tasks across 77 Common Weakness Enumeration (CWE) types-seven times more than previous benchmarks-and drew from 108 open-source projects.

This isn't just a lab curiosity. Databricks' security research from August 2024 found that approximately 45% of code generated by popular AI tools fails security tests and introduces OWASP Top 10 vulnerabilities. We’re talking about SQL injection, cross-site scripting (XSS), and authentication bypass flaws. The model might produce a parser that correctly reads a GGUF binary format, but if it lacks proper input validation, it becomes a critical entry point for attackers. The gap between "it works" and "it is safe" is where vibe coding lives, and it is a dangerous place.

Assessing Severity: Beyond Standard CVSS Scores

In traditional development, we rely on the Common Vulnerability Scoring System (CVSS) to rate severity. While still useful, vibe coding demands a modified lens. Escape.tech’s 2024 research analyzed over 2,000 verified vulnerabilities in vibe-coded applications and revealed a skewed distribution of risk. Sixty-two percent of these vulnerabilities involved exposed secrets or personally identifiable information (PII). Another 28% represented critical access control failures.

Why is this different? Because LLMs tend to replicate patterns. If the training data contains hardcoded API keys or insecure default configurations, the model will reproduce them with high confidence. A single insecure pattern can propagate across multiple generated components instantly. Therefore, when triaging, you must weight "Exposure" higher than usual. ReversingLabs’ security team recommends a modified DREAD model for vibe coding:

• Exposure (40%): How easily can the vulnerability be discovered? AI-generated code often follows predictable, public patterns.
• Damage (30%): What is the potential harm? Data leaks are common in AI outputs.
• Reproducibility (15%): Can the bug be triggered consistently?
• Exploitability (10%): How hard is it to write an exploit?
• Affected Users (5%): Who is impacted?

By shifting the weight toward Exposure and Damage, you acknowledge that AI-generated vulnerabilities are often trivial to find and devastating to exploit.

Evaluating Exploitability: The Path of Least Resistance

Not all vulnerabilities are created equal in terms of how easy they are to exploit. Vidoc Security’s taxonomy categorizes vibe coding risks by exploitability vectors, providing a clear hierarchy for triage. You need to prioritize issues that require little effort for an attacker to weaponize.

Hardcoded secrets are the low-hanging fruit. LLMs often insert placeholder credentials or copy-paste real keys from training data. These are exploitable in 100% of cases with trivial effort. Broken authorization is another major pitfall; models may generate endpoints that lack proper user verification checks, leading to unauthorized data access. Insecure deserialization, while requiring more advanced skills, remains a significant threat due to its prevalence in AI-generated backend logic. Your triage process must flag these categories immediately, regardless of other factors.

Measuring Impact: The Compounded Risk of AI Patterns

Impact assessment in vibe coding is not just about one broken function. It’s about the ripple effect. When an LLM generates a module, it often uses similar patterns across related files. A flaw in one authentication handler might appear in five others. This compounding risk means the impact of a single vulnerability is magnified.

Nucamp’s security analysis advises treating AI output like a junior developer’s draft. You cannot trust it implicitly. Instead, you need a dual-layer evaluation approach. First, use automated tools to catch obvious errors. Second, conduct manual inspection of critical logic paths. Elizabeth Wilson’s independent testing showed that tools like Snyk detect 92% of open-source vulnerabilities, but they miss context-specific issues that only a human reviewer can spot. For example, an LLM might correctly implement encryption but fail to secure the key storage mechanism-a nuance that requires contextual understanding.

Duda.co documented real-world cases where marketing agencies using vibe-coded websites exposed client data due to insufficient input validation. Forty-five percent of their failures on OWASP Top 10 tests were directly attributable to AI-generated code lacking proper security context. The impact wasn't just a bug; it was a breach of client trust and potential regulatory fines.

A Three-Level Triage Framework for Vibe Coding

To manage this complexity, you need a structured framework. Aikido.dev proposes a three-level security checklist that formalizes triaging priorities. Implementing this structure ensures that security is integrated into the development loop, not bolted on at the end.

Level 1: Automated CI/CD Integration

Start with your pipeline. Integrate Static Application Security Testing (SAST) tools like SonarQube, which detects 85% of code quality and security issues according to Susan Taylor’s benchmarking. Pair this with Dynamic Application Security Testing (DAST) using tools like OWASP ZAP. These tools run automatically on every commit, catching basic syntax errors and known vulnerability patterns. This is your first line of defense.

Level 2: AI Self-Review Capabilities

Here’s where it gets interesting. Prompt the LLM to review its own code. Databricks found that implementing a self-reflective review step-feeding the generated code back into the model with specific security prompts-reduced vulnerability rates by 57% in PurpleLlama’s Cybersecurity Benchmark tests. Ask the model to identify hardcoded secrets, verify data accessibility, and scan for vulnerable dependencies. It’s not perfect, but it catches many obvious oversights.

Level 3: Organizational Policy and Secret Management

Finally, enforce organizational policies. Mandate secret scanning across repositories, wikis, and chat platforms. Use tools like GitGuardian, whose 2024 State of Secrets Sprawl report highlighted the importance of automatic revocation and rotation SLAs. If a secret is leaked, it must be rotated immediately. This level addresses the human and procedural aspects of security, ensuring that even if the AI slips up, the damage is contained.

The Human Element: Why Expertise Still Matters

Despite advances in AI-assisted triaging, human expertise remains irreplaceable. The arXiv study noted that when researchers prompted models to fix vulnerabilities, the models introduced new issues in 68% of cases. LLMs lack true security context awareness. They don’t understand the business logic or the broader architectural implications of a change.

Google Cloud’s 2025 Security Command Center update introduced vibe coding-specific vulnerability prioritization, reducing false positives by 42% through contextual understanding. IBM Research demonstrated that combining automated scanning with structured LLM-based reflection catches 91% of vulnerabilities that either method would miss alone. But notice the keyword: "combining." The best results come from a hybrid approach where humans guide the AI, validate its findings, and make final decisions on risk acceptance.

As you triage vulnerabilities in vibe-coded projects, remember that speed should never compromise security. By focusing on severity, exploitability, and impact, and by implementing a robust, multi-layered triage framework, you can harness the power of AI without exposing your organization to unnecessary risk. The future of development is fast, but it must also be secure.