---
id: 1908
title: "Bad Vibes: Comparing the Secure Coding Capabilities of Popular Coding Agents"
source_domain: tenzai.com
source_url: "https://www.tenzai.com/blog/bad-vibes-comparing-the-secure-coding-capabilities-of-popular-coding-agents"
published_at: "2026-06-25 00:00"
tags: ["ai-security", "appsec", "benchmark", "secure-coding", "ai-agents", "llm", "vibe-coding", "vulnerabilities", "ssrf", "vulnerability-analysis", "code-generation", "ai-coding-agents"]
phying_url: "https://phying.com/item/1908"
lang: en
---

# Bad Vibes: Comparing the Secure Coding Capabilities of Popular Coding Agents

## Summary

A Tenzai benchmark had five AI coding agents—Cursor, Claude Code, Codex, Replit, Devin—build 15 identical apps, uncovering 69 vulnerabilities including broken auth and SSRF.

## Intelligence Metadata

- **Sources:** tenzai.com
- **Published:** 2026-06-25 00:00
- **Original:** https://www.tenzai.com/blog/bad-vibes-comparing-the-secure-coding-capabilities-of-popular-coding-agents
- **Phying News:** https://phying.com/item/1908