78 CVEs traced to AI-generated code, 35 of them in a single month. And those are just the traceable ones.

Date

Mar 2026

Tools involved

Claude Code, github-copilot, gemini-cli

Impact

78 AI-linked CVEs (43 Critical or High) from May 2025 to March 2026, with 35 in March 2026 alone; estimated true count 5 to 10x higher

Root cause

AI coding tools shipping exploitable vulnerabilities into real software, with most cases untraceable because AI-assisted commits lack origin metadata

What happened

Researchers at Georgia Tech's Systems Software and Security Lab built the Vibe Security Radar, a public tracker documenting real Common Vulnerabilities and Exposures (CVEs) where AI-generated code introduced the flaw. Covering May 1, 2025 through March 24, 2026, it recorded 78 AI-linked CVEs across eight AI coding tools, with 43 rated Critical or High severity.

The data showed a sharp acceleration. The last seven months of 2025 produced roughly 18 cases. The first three months of 2026 produced 56: 6 in January, 15 in February, and then 35 in March 2026 alone, more than all of 2025 combined.

The tracker's headline number is also, by its authors' own account, a floor. Researcher Hanqing Zhao estimated the true count is five to ten times higher, because many AI-assisted commits lack metadata linking a vulnerability back to an AI origin. If nothing marks a commit as AI-generated, the resulting CVE simply cannot be traced, so most never make the tally.

Covered by Georgia Tech Research, Infosecurity Magazine, and the Cloud Security Alliance, the tracker functions as a running, quantified incident feed. It converts the abstract concern that AI writes insecure code into a countable, accelerating tally of shipped, exploitable vulnerabilities.

Impact

Seventy-eight CVEs is not an abstraction; each entry is a shipped, catalogued, exploitable vulnerability in real software, and 43 of the 78 were rated Critical or High severity. The trend is the alarming part: roughly 18 cases in the last seven months of 2025 became 56 in the first three months of 2026, with March 2026's 35 exceeding all of 2025 combined. And per researcher Hanqing Zhao's estimate, the tracked figure understates reality by five to ten times, because vulnerabilities from untagged AI commits never get attributed at all.

Root cause

Two failures stack here. First, AI coding tools introduce exploitable flaws into code that ships, at a pace that accelerated sharply through early 2026 across the eight tools the tracker covers. Second, the ecosystem has no reliable way to notice: most AI-assisted commits carry no metadata identifying their origin, so when a vulnerability surfaces later, nothing connects it back to the tool that wrote it. The result is a threat that is measurably growing and structurally undercounted at the same time.

How to not be this entry

• Security-review every AI-generated diff before it merges, with specific attention to injection flaws, which ship in AI code by default. Read the fix guide: SQL injection and XSS in AI-generated code
• Verify authentication and authorization on every AI-generated endpoint; a missing auth check is exactly the kind of flaw that becomes a Critical CVE later. Read the fix guide: No auth on your AI-generated API endpoints: anyone can call your backend
• Tag AI-generated and AI-assisted commits in your repo metadata. The Radar's 5 to 10x undercount exists because most teams cannot trace which code came from an AI; make sure you can.
• Scan for hardcoded secrets before every push, since leaked credentials turn a code flaw into an account compromise. Read the fix guide: Accidentally committed an API key to GitHub

Tools that actually fix this

Recommended because they address the failure mode above, not because of the payout. Some are affiliate links; see how we choose.

Frequently asked questions

Sources

• Georgia Tech Research: Bad vibes, researchers warn AI-generated code is vulnerable
• Infosecurity Magazine: AI-generated code vulnerabilities surge
• Cloud Security Alliance: Research note on the 2026 AI-generated code vulnerability surge

Related error guides