PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Bad Vibes: Comparing the Secure Coding Capabilities of Popular Coding Agents

tenzai.com | blog | #ai-security | #appsec | #benchmark | #secure-coding | #ai-agents | #llm | #vibe-coding | #vulnerabilities | #ssrf | #vulnerability-analysis | #code-generation | #ai-coding-agents
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A Tenzai benchmark had five AI coding agents—Cursor, Claude Code, Codex, Replit, Devin—build 15 identical apps, uncovering 69 vulnerabilities including broken auth and SSRF.
Published
Collected

Related coverage

blog · borghq.io
Security Review for AI-Generated Code: What Changes Before Merge
More of every pull request is machine-drafted and the bug classes have not changed. What security review must catch in the diff before merge, and what it cannot.
blog · netspi.com
Vibe Coding: A Pentester’s Dream
NetSPI vibe-coded a web app with AI coding tools and tested it for vulnerabilities; the results were mixed, showing why AI-generated code still needs proactive security review.
tool · projectdiscovery.io
Inside the benchmark: app architectures, walkthroughs of findings, and what each scanner actually caught
Part 2 of the vibe coding benchmark dissects three AI-built apps (healthcare, banking, insurance), detailing what Neo caught, what Claude Code got wrong, and what both missed on AI-generated code.
blog · tenzai.com
Five Models Walk Into an App Builder. Security Gets Interesting.
# Five Models Walk Into an App Builder. Security Gets Interesting. Eran Machlev Security Researcher Share We built the same three apps with five models on Base44 and ran Tenzai's AI hacker against...
blog · about.gitlab.com
GPT-6 Astra on GitLab: Faster runs, fewer tokens used
GitLab's internal eval of GPT-6 Astra on Duo Agent Platform: up to 43.4% faster typical runs than GPT-5.6 Sol (49.2% at p95) and 42.7% fewer tokens, traded against a lower resolution rate.
blog · bugcrowd.com
How vulnerable are vibe-coded apps?
The author built the same app with two LLMs and reviewed the results: vibe coding ships fast, but finite context windows and skipped security reviews can turn velocity into real vulnerabilities.
Back