A recent study by Tenzai has brought to light significant security concerns surrounding AI-powered coding tools such as Claude Code, OpenAI Codex, Cursor, Replit, and Devin. The research revealed that these popular vibe coding tools are not entirely reliable, as they generated a total of 69 vulnerabilities across 15 test applications. These vulnerabilities include critical flaws mainly centered around API authorization and business logic.
While these tools have successfully learned to avoid common issues like SQL injection and cross-site scripting (XSS) attacks, they continue to struggle with context-dependent security decisions. One key concern highlighted by the study is their lack of intuitive understanding that human developers generally possess when it comes to complex business logic. This shortcoming makes AI-generated code particularly susceptible to authorization and workflow vulnerabilities, such as authentication bypasses and negative pricing.
Remarkably, the study demonstrated that when five different AI agents were tested using identical prompts, they consistently produced similar counts of vulnerabilities, underscoring potential risks faced by developers who lack adequate security expertise or fail to conduct thorough code reviews. Notably, critical flaws were found in systems generated by Claude Code, Devin, and Codex, particularly affecting API authorization and business logic.
To mitigate these risks, experts recommend embedding security checks directly into AI coding environments. Relying solely on post-generation debugging and manual code review may not suffice, as proactive integration of security solutions can provide a more effective safeguard against such vulnerabilities. This comprehensive approach emphasizes continued human oversight and an integrated security framework during the code generation process to ensure the development of more secure applications.

Collections

A Tenzai study found that AI coding tools like Claude Code, OpenAI Codex, Cursor, Replit, and Devin generated 69 security vulnerabilities across 15 test applications. While these tools avoid common issues like SQL injection and XSS, they struggle with context-dependent security decisions, particularly around API authorization and business logic. The study showed consistent vulnerability patterns across different AI agents using identical prompts. Experts recommend embedding security checks directly into AI coding environments rather than relying solely on post-generation reviews and manual debugging.

AI Coding Tools Prone to Critical Security Flaws, Study Reveals