AI Writes Code Faster Than Anyone Can Review It. That Is the Problem.
Nearly half of AI-generated code fails basic security tests, and one study found AI code carries 2.7 times the vulnerability density of human-written code. How to use AI coding tools without shipping holes.
By the UISC BD Editorial Desk · United Information Service Center · Published 13 September 2026 · 7-minute read
Vibe coding is the name for a way of building software where the developer stops writing code line by line and instead describes what they want, then accepts what the AI produces. The developer becomes a curator and orchestrator rather than an author.
It is genuinely fast. It is also producing a security problem that security teams were not built to handle.
What the Research Found
- Nearly half of AI-generated code fails basic security tests.
- AI-generated code showed 2.7 times the vulnerability density of human-written code in one analysis.
- Across studies, 40 to 62 percent of AI code samples contained vulnerabilities.
- 19.7 percent of AI code samples contained at least one package name that does not exist.
The consequence is that unreviewed output is reaching production faster than most application-security programmes were designed to catch.
The Invented-Package Trap
The last number deserves its own section, because it is the risk most beginners have never heard of.
When an AI suggests importing a library that does not exist, the obvious outcome is an error. The dangerous outcome is that an attacker has already published a malicious package under that invented name, waiting for developers who install whatever the AI recommends.
The defence is simple and non-negotiable: never install a dependency you have not verified exists, is maintained, and is the one you meant. This is the coding version of the checking routine in our guide to AI errors.
The Named Risks
Current security guidance lists the top vibe-coding risks as:
- Insecure code patterns — the AI reproduces common, unsafe examples from its training data.
- Exposed secrets — API keys and passwords written straight into code.
- Hallucinated dependencies — as above.
- Weak authentication — login and permission checks that look present but are bypassable.
- Over-permissioned agents — AI tools given more system access than the task needs.
- Prompt injection — malicious instructions hidden in content the AI reads.
- Loose configurations — insecure defaults left in place.
- Skipped review — code merged because it worked in a demo.
- Shadow AI — tools used without the organisation knowing.
Why Review Gets Harder, Not Easier
AI-assisted developers produce more than three times as many commits as their peers, but package them into fewer, much larger pull requests that touch many files and services at once.
A reviewer can look carefully at forty changed lines. Nobody reviews four thousand carefully. Large changes get approved on trust, and that is exactly where the vulnerabilities above slip through — building technical debt that compounds quietly until it becomes unmanageable.
How to Use AI Coding Tools Safely
Keep changes small. Ask for one function at a time, not a whole feature. Small diffs are reviewable diffs.
Make it explain. Ask the AI why it chose each approach and what could go wrong. Weak reasoning often exposes weak code.
Ask for the security review separately. In a fresh conversation, paste the code and ask specifically for injection flaws, missing input validation, hard-coded secrets and authentication gaps.
Run automated scanners. Static analysis and dependency scanning catch a large share of these issues at almost no cost.
Never paste real secrets into prompts. Use placeholders and environment variables.
Understand before you merge. If you cannot explain what a block of code does, it is not ready to ship — no matter who or what wrote it.
What This Means for Bangladesh's Software Sector
Bangladeshi software exporters and freelance developers compete on delivering working code for overseas clients. AI tools raise output dramatically.
They also move the value. Anyone can now generate code. Clients will increasingly pay for code that is secure, reviewed and maintainable — which is a skill, and one worth building deliberately rather than assuming the tool provides it.
Related reading
- Asking AI About Your Health? The Risks, and How to Do It Safely
- How to Write an AI Prompt in 2026: What Actually Changed
- The Browser That Locks Down: Bangladesh's Billion-Dollar Bet
- How to Build Your First AI Agent Without Getting Burned
Sources
- "Vibe coding security: risks and vulnerabilities," Cycode — cycode.com
- "Vibe coding security risks aren't like ordinary security risks," IBM — ibm.com
- "Vibe coding security risks you can't ignore 2026," Arnica — arnica.io
- "Vibe coding trends 2026: adoption, productivity, and code quality data," Keyhole Software — keyholesoftware.com
Comments