Vibe coding is an AI-heavy approach to software development in which a person describes desired behavior in natural language and accepts generated code for much or all of a project, often with little or no review. section 6.6 section 5.2
The practice extends ordinary coding assistance: a developer can describe a function in a comment or docstring, receive a reasonable first attempt, and iterate more quickly. Agentic tools such as Claude Code, Cursor AI, Replit Agent, and Windsurf can take actions directly rather than merely suggest completions. section 6.6
Vibe coding can make software creation more accessible, but it shifts important responsibility toward verification:
- Generated code may contain subtle vulnerabilities when users lack the expertise or incentives to audit it. section 5.2
- Hallucinated package names can enable slopsquatting, in which attackers register malicious dependencies resembling commonly suggested names. section 5.2
- Unreviewed snippets such as file-upload handlers may omit safeguards against remote code execution, privilege escalation, or data leakage. section 5.2
- These weaknesses can remain unnoticed during development and become embedded across systems as AI-assisted coding spreads among technical and non-technical users. section 5.2
From prompt to insecure dependency
A user can ask an LLM to create an application and install the dependencies it suggests without checking their origins. If a suggested package name is hallucinated and an attacker has registered it, the application may unknowingly incorporate malware. section 5.2
