For the past eighteen months, the loudest story in software has been how easy it is to build things. Describe what you want, watch the code appear, deploy it by Friday. The industry even gave it a name: vibe coding. You do not read the code, you feel your way to a working product.
It works, up to a point. And this spring, the research arrived showing exactly where that point is.
AI-generated code carries roughly 2.74 times more security flaws than human-written code, according to research covered by Forbes and detailed in a Cloud Security Alliance research note. That is not a rounding error. That is a different risk category.
It gets more concrete. Researchers scanned 5,600 publicly deployed vibe-coded applications, the kind of apps real businesses are putting in front of real customers. They found over 2,000 high-impact vulnerabilities and 400 exposed secrets, things like API keys and database credentials sitting in the open. Roughly one in three AI-built apps shipped with a serious, exploitable flaw. Around 40% were exposing sensitive data: medical records, financial details, customer information.
Read that last sentence again. These are not toy projects. These are deployed applications handling the exact categories of data that trigger regulatory action, insurance claims and reputational damage.
This is not a fringe problem
It would be comforting to think this only affects hobbyists. The numbers say otherwise.
Y Combinator, the most influential startup accelerator in the world, said a quarter of a recent cohort had codebases that were 95% AI-generated. These are funded companies with paying customers and investor money behind them.
And it is not just startups. According to the US Chamber of Commerce, one in five small businesses now use AI coding tools. That is a huge shift in who is writing software. Owners, marketers and operations people are building internal tools, customer portals and booking systems that would have needed a development agency two years ago.
In many ways that is genuinely good news. The barrier to building software has collapsed, and plenty of the software being built is useful. The problem is not that non-developers are building things. The problem is what happens next.
The code was never the expensive part. Knowing whether the code is safe to run against real customer data, that was always the expensive part.
Vibe coding compresses the cheap part of software development to nearly zero and quietly skips the expensive part entirely. The result looks like a finished product. It demos beautifully. It might even run fine for months. The debt only comes due when someone hostile finds it, and the scan of those 5,600 apps tells us hostile parties will not have to look hard.
Why AI code fails differently
It is worth understanding why the flaw rate is so much higher, because it is not that the models are stupid. They are trained on enormous amounts of public code, and enormous amounts of public code is insecure. The model reproduces the patterns it has seen, including the bad ones, with total confidence.
Worse, AI-generated flaws are systematic rather than random. A human developer makes idiosyncratic mistakes. A model makes the same class of mistake across every project it touches: authentication checks that look right but can be bypassed, secrets hard-coded because that is what the training examples did, input handling that trusts the user far too much.
A human reviewer would catch most of these in an afternoon. In a vibe-coded workflow, there is no reviewer. That is the entire gap. The 2.74x figure is not really a measurement of AI capability. It is a measurement of what happens when the review step disappears.
There is also an accountability gap. When an agency or a contractor ships you insecure software, someone is professionally responsible for it. When a chatbot ships you insecure software, the responsibility lands entirely on you, and most business owners do not realise they have accepted it.
We use these tools ourselves
Let us be clear about where we stand, because this is not an anti-AI argument.
Flux Dynamics uses AI coding tools daily, openly and enthusiastically. They have changed how quickly good software can be built, and any consultancy claiming otherwise is either lying or falling behind. The productivity gain is real and we pass it on to clients.
The difference is not whether AI writes the first draft of the code. The difference is what stands between that first draft and production: engineering review, security fundamentals, and someone accountable who has actually read what is being deployed. AI is a phenomenal accelerant for an engineer. It is a liability multiplier for a business with no engineering oversight at all.
We are not anti-AI. We are anti-unreviewed. Those are very different positions, and the research above is the evidence for why the distinction matters.
What to do about it
If your business has AI-built software in production, or is about to, here is the practical version.
Take an inventory. Know what has been built, by whom, with what tools, and what data it touches. The dangerous systems are the ones nobody remembers to list.
Sort by data sensitivity, not by size. A tiny internal tool that touches customer payment details is a bigger risk than a large app that touches nothing personal. Anything handling medical, financial or customer records goes to the top of the pile.
Get the high-risk systems reviewed by someone who can read code. Not a full rewrite, a review. An experienced engineer can find exposed secrets, broken authentication and unsafe data handling quickly. Most of the flaws in that 5,600-app scan were common, known categories that a competent review catches.
Check for exposed secrets today. Of everything in the research, the 400 exposed secrets are the cheapest to fix and the fastest to exploit. If an API key or database credential has ever been in your code, rotate it.
Keep using AI tools, but change the rule. The rule is simple: AI can write code, but unreviewed code does not touch production data. Draft with AI, review with a human, ship with accountability. You keep almost all of the speed and shed most of the risk.
Decide who is accountable. Someone specific should be answerable for the security of each system you run. If the honest answer is “nobody”, that is the finding.
None of this is exotic. It is the ordinary discipline of software engineering, applied to a new and much faster way of producing code. The businesses that pair AI speed with human review will compound the advantage. The ones that skip the review are building the case studies for next year’s research.
Flux Dynamics reviews, hardens and takes accountability for AI-built software so SMEs get the speed without the security debt. Start a project with us if you have code in production that nobody has properly reviewed.