Vibe Coding y Seguridad: Análisis de Riesgos, Vulnerabilidades y Estrategias de Mitigación en el Desarrollo Asistido por IA. - Torres Guerrero, Francisco; Trevino Roman, Sergio Alexander (Revista Daena: International Journal of Good Conscience)
"Vibe coding" is an emerging software development paradigm driven by generative artificial intelligence, coined by Andrej Karpathy in February 2025, which enables both developers and non-developers to create complex applications through natural languageinstructions. While this approach democratizes access to software development and significantly accelerates code production, it introduces a critical dimension of security risks requiring urgent academic and practical attention. This article systematically analyzes the security vulnerabilities associated with vibe coding, drawing on empirical evidence from recent studies reporting over 2,000 vulnerabilities identified across 5,600 vibe-coded applications, and 69 vulnerabilities detected in direct evaluations of leading tools such as Claude Code, OpenAI Codex, Cursor, Replit, and Devin. Key risk categories are identified: code injection, exposed credentials, insecure configurations, software supply chain weaknesses, and the erosion of technical knowledge. A responsible AI-assisted development framework is proposed, integrating security principles from the design phase, including security-oriented prompting, mandatory human review, SAST/DAST tool integration in CI/CD pipelines, and the cultivation of a security-minded organizational culture.