AI-Generated Code Produced More New Vulnerabilities in One Month Than All of 2025

Georgia Tech's Vibe Security Radar recorded 35 new CVEs originating from AI-generated code in March 2026 alone, more than the total tracked across all of 2025 combined, according to Georgia Tech Research News. That is not a gradual uptick. It is a step change in a single month.

The number sits alongside broader research the same reporting cites: AI-written code carries security flaws at 2.74 times the rate of human-written code, with somewhere between 40% and 62% of AI-generated code containing at least one vulnerability. A separate figure on secret leakage tells a similar story, a 3.2% rate of leaked credentials or keys in AI-assisted commits versus a 1.5% baseline in commits written entirely by humans.

The case study attached to the research is Moltbook, a site built almost entirely through vibe coding, prompting an AI model to write the application with minimal human review of the output. In February 2026, a misconfigured database exposed 1.5 million auth tokens and 35,000 emails. Nothing exotic caused that exposure. It was the kind of configuration mistake code review typically catches, except there was little code review to catch it.

None of this means AI coding tools are unusable, and plenty of teams pair them with the same review discipline they'd apply to any other contributor's pull request. The Moltbook case and the March 2026 CVE spike both point to the same failure mode, though: skipping review because the code came from a model that sounds confident is exactly how a routine misconfiguration turns into a breach affecting millions of records. Treat AI-generated code as a first draft from a fast, inexperienced contributor, not a finished product, and the review step stays where it belongs, before the deploy.