Six CVEs in January. Thirty-Five in March. AI-Generated Code Has a Trend Line

Researchers tracking vulnerabilities specifically attributed to AI-generated code logged six new CVEs in January 2026. By March, that number was thirty-five. That's not a blip, it's a trend line, and it's climbing in the same direction adoption is: up and to the right.

This is the number every vibe coder should sit with for a second before shipping the next feature.

What's actually being tracked

Georgia Tech's Systems Software & Security Lab runs what they call the Vibe Security Radar, a project specifically tracking CVEs with direct attribution to AI-generated code, not code that happened to be written by a human who used an AI autocomplete, but vulnerabilities traced to output from AI coding tools like Lovable, Replit, Cursor, and similar platforms. The monthly count has climbed steadily through 2026, and separate research backs up the pattern: developers using AI coding tools ship 3 to 4 times more commits than their peers, but introduce security findings at roughly 10 times the rate.

Speed went up. Review didn't keep pace. That gap is exactly where these CVEs are coming from.

The bold version of this story, and the real one

Here's the headline that gets clicks: AI-generated code is riddled with vulnerabilities, and the numbers keep getting worse. That's true, and it's worth taking seriously.

But it's not the whole picture, and treating it as the whole picture leads to bad decisions, like avoiding AI tools altogether or running the same paranoid checklist on every app you ship. The CVEs being tracked skew heavily toward a specific pattern: apps that touch real user data, handle authentication, or expose APIs without review. A static landing page built the same week carries almost none of this risk, because there's nothing there to exploit.

The real story isn't "AI-generated code is dangerous." It's "AI-generated code that handles sensitive data or user access, without anyone checking the output, is where the vulnerabilities concentrate." What your app actually does determines how much of this trend line applies to you. A personal project and a fintech tool sitting on the same platform are not the same risk.

What's actually driving the numbers

A few patterns show up repeatedly in the research behind this data:

Iteration compounds risk. Code that goes through multiple rounds of AI-driven refinement can end up with significantly more critical vulnerabilities than the first version, not fewer. Each "fix this bug" prompt can quietly reintroduce or create new issues nobody's checking for.

Scale amplifies exposure. Large-scale scans of publicly deployed vibe-coded apps have turned up thousands of critical vulnerabilities, hundreds of exposed API keys and secrets, and real instances of exposed personal data, including medical and payment information, sitting in apps that were never meant to hold that kind of risk without protection.

Nobody's the second reviewer. Traditional development has code review built in. Vibe coding, especially for solopreneurs and small teams, often doesn't. The AI writes it, it works, it ships. The review step that used to catch these issues before production isn't part of the workflow for most builders at all.

We saw this pattern up close with the Odido, Booking.com, and Basic-Fit breaches that exposed Dutch citizens' data earlier this year: the vulnerability wasn't exotic, it was something a review step would have caught.

What to actually do about it

You don't need to memorize CVE numbers. You need a review step that didn't exist in your workflow before. Three things worth doing regardless of what platform you're building on:

Check what your app actually exposes. API keys, database rules, authentication flows. This is the same ground we cover in the 5 security gaps hiding in every vibe-coded app, and it's still where most of these CVEs originate.

Re-check after every major iteration, not only at launch. If refinement rounds are where risk compounds, your review needs to happen more than once.

Scope your review to what your app actually does. A tool with no user accounts and no sensitive data doesn't need the same scrutiny as one handling payments or health records. Spend your review time where the risk actually lives.

This is exactly what NEKOD's 360° assessment is built for: not a generic vulnerability scan run identically on every app, but a review that adapts to what your app touches, what data flows through it, and what's actually at stake if something's missed.

We're planning [ADD ARTICLE: What We Found Scanning the Top 10 Vibe-Coded Apps Post-Lovable Breach] as a follow-up, putting real scan data next to this CVE trend.

Key takeaways

• Tracked CVEs in AI-generated code rose from 6 in January 2026 to 35 in March, and the trend is still climbing.
• AI-assisted developers ship far more code, and introduce security findings at roughly 10x the rate of their peers.
• Risk concentrates in apps handling user data, authentication, or APIs, not in every vibe-coded project equally.
• Multiple rounds of AI-driven refinement can add vulnerabilities instead of removing them.
• The fix is a review step scoped to what your app actually does, not fear of the tools themselves.

Want to know where your app sits on this trend line? Get your free scan and find out what NEKOD's 360° review catches before your users do.