SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Study finds 98% of AI-generated 'vibe-coded' apps have security flaws

0
·1 views

A June 2026 scan by Symbiotic Security of over 1,000 Supabase-backed apps built with AI coding tools found that 98% contained at least one security vulnerability, with 16% carrying critical flaws. A separate academic study identified recurring vulnerability patterns unique to AI-generated codebases, suggesting structural rather than random weaknesses. An Xint.io analysis flagged 434 exploitable issues concentrated in secrets exposure, broken authorization, and denial-of-service vectors. Common failure points include exposed .env files, leaked API keys in browser code, misconfigured row-level security, and missing HTTP security headers. Security researchers note these issues are predictable and can typically be audited manually in around 15 minutes using basic tools like curl and browser developer tools.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Developer loses 4 days of AI access, spends €200 after overnight automation hits hidden weekly cap

A developer running Claude Code on a flat monthly subscription lost access to the AI tool for four days after an overnight automation loop exhausted his weekly usage limit in just two days. He was unaware that Anthropic had added a weekly cap on top of the monthly one, having never approached either limit during normal use. To meet client deadlines mid-lockout, he purchased additional tokens at full list price, spending €200 over four days at reduced productivity. The incident exposed a blind spot: no tool was warning him in real time how quickly his weekly allowance was being consumed. He subsequently built a usage meter through four iterative attempts to surface that information in plain, actionable language.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AgentATC Uses OpenTelemetry to Expose Silent Failures in Multi-Agent AI Systems

AgentATC is an open-source project built for the 'Agents of SigNoz' Hackathon (WeMakeDevs × SigNoz, July 2026) that addresses a blind spot in AI observability: multi-agent coordination failures that produce no errors or alerts. The system runs a three-agent workflow — Planner, Executor, and Critic — to generate competitive analysis reports, where every inter-agent handoff is recorded as a first-class OpenTelemetry span. A single shared trace ID links all subtasks, preventing fragmented traces and making the full execution history visible in one connected view. To demonstrate the problem, one subtask is deliberately designed to loop endlessly, as the Executor can never satisfy the Critic's rubric, burning LLM tokens silently without triggering any exception or dashboard alert. AgentATC argues that traditional observability tools measure latency, errors, and cost per call, but are not designed to detect coordination breakdowns between agents.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Rust library ez-ffmpeg 0.15 offers single-call in-process video frame extraction

Extracting video frames in Rust for machine learning inference has long required either shelling out to FFmpeg via the command line or hand-writing a low-level decode loop spanning dozens of lines. The newly released ez-ffmpeg 0.15 introduces a FrameExtractor API that handles frame extraction in-process with a single function call, returning tightly packed RGB24 bytes ready for use with tensors or ndarray. The library supports flexible sampling strategies, including uniform frame distribution across a video clip, making it well-suited for vision-language model pipelines. A notable issue with many existing approaches — incorrect application of BT.601 color coefficients to HD video, causing subtle color distortion — is also addressed by the library. ez-ffmpeg links against libav through ffmpeg-next and requires FFmpeg 7.1 or later to be installed on the system.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Replicates Anthropic's Vision-Only Pokémon Claim, But Thinking Logs Raise Questions

A developer independently replicated Anthropic's claim that its Claude Fable 5 model can play Pokémon FireRed using only raw screenshots, building a matching harness that reached the first gym badge in 1,785 turns at a cost of $65.40. The experiment confirmed the core result is real, with full logs, frames, and harness code made publicly available for scrutiny. However, after examining the model's thinking chains, the developer found Claude was recalling memorized game knowledge — such as specific trainer dialogue and city objectives — rather than reasoning purely from visual input. The model had written down plot objectives 141 turns before they appeared on screen and identified off-screen trainer details by memory, suggesting its performance relies heavily on training data rather than vision-based reasoning. This raises questions about what 'vision-only' truly means in this context, as Anthropic published no harness code, step count, cost, or definition of 'minimal' alongside its original announcement.

0 comments Read more at DEV Community
Study finds 98% of AI-generated 'vibe-coded' apps have security flaws · ShortSingh