The research

Why security needs its own checks.

Research on generated code and reported vulnerabilities, with the scope and source behind each claim.

186

tasks in the SusVibes benchmark

Selected feature-request tasks from open-source projects, evaluated across 12 coding-agent settings. This is not a survey of deployed apps.

SusVibes, revision September 21, 2026
45%

of generated code failed the study’s security tests

Veracode’s 2025 evaluation covered 80 coding tasks, four languages and more than 100 models. The rate applies to that test set.

Veracode, 2025 GenAI research
74

confirmed cases reported by Vibe Security Radar

Georgia Tech’s April report links vulnerabilities to AI-assisted code using repository metadata. This is a dated count, not a live total or prevalence rate.

Georgia Tech, April 13, 2026
RLS

permissions need more than a login screen

A 2025 disclosure described public access to private data in affected Lovable-built apps using Supabase. It does not establish the current state of every Lovable app.

Palmer and Low, 2025 disclosure

Sources reviewed October 5, 2026. These studies use different samples and methods; they are not estimates of how many apps are insecure today or measures of VAS coverage. Explore the research and methodology.

Where AI tools commonly slip up

vas scans for these issues in minutes. Our scanners are specifically tuned for AI-built application vulnerabilities.