AI Wrote the Code. The CVE Is Still Yours.

This piece is my read on research published by the Georgia Tech team behind Vibe Security Radar. The findings are theirs; the argument about what they mean is mine. Their original write-up is worth reading in full.

Anyone doing vibe coding today without security testing is playing Russian roulette. Here is the proof.

Researchers at Georgia Tech built a tool called Vibe Security Radar. What does it do? It scans real vulnerability databases – actual CVEs – and traces backwards through git blame to the original commit. Then it checks whether that code was written by AI.

They identified more than 15 signatures of AI tools in code: bot email addresses, characteristic commit messages, co-author signatures from Copilot and its relatives.

And the result? Real security vulnerabilities, with official CVEs, that went into production because somebody pressed Accept on automatically generated code.

Let’s understand the size of the problem. They cloned nearly ten thousand repositories. Over two terabytes of disk. Six stages of analysis, including deep investigation with an LLM running up to fifty tool calls per case. And they themselves admit that what they find is only the lower bound – because not all AI code leaves a signature.

I have been saying this for two years

Code written by AI is not magic. It is code. And code needs testing: penetration testing, security testing, code review by somebody who understands what they are reading.

The problem is not the AI. The problem is the illusion that you can skip the process because the code looks clean. SQL injection did not become less dangerous because Copilot wrote the line. Prompt injection did not disappear because the code went through autocomplete.

We see this at clients. Code arrives that looks perfect – tidy, documented, with nice comments. Then we run a penetration test and find holes a beginner would not have made. Because the AI knew how to write beautiful code. It did not know how to think like an attacker.

There are no shortcuts in security. There were none before AI and there will be none after.

I first shared a version of this as a LinkedIn post on 2026-04-20. It is republished here, lightly edited, so it is easier to find and reference. — Erez Metula