Georgia Tech SSLab · Security research · Data through Sep 26, 2026
Vibe Security Radar
310 published CVEs and GitHub advisories traced to AI-assisted code changes, each with the vulnerable code and the fix.
Browse all 310 findings →Star on GitHub ↗How we verify
- Findings
- 310
- AI-contributed vulnerabilities
- Covered advisories
- 30,966
- May 2025 – Sep 2026
- Fully researched
- 4,359
- 14% of covered advisories so far
- Projects
- 144
- Most represented project: openclaw/openclaw
Findings per month
Full trend ↓55
May 2025Peak advisory month: Jul 2026Oct 2026
AI tools
vs. commits ↓
Claude81%
GitHub Copilot7.0%
Cursor6.0%
ChatGPT/Codex5.3%
Most common AI tool among findings that name one.
Disclosures over time
310 findings by advisory publication month, May 2025 – Oct 2026. Data through Sep 26, 2026.
Findings per monthHover or tap a month for details
| Month | Findings | Advisories researched |
|---|---|---|
| May 2025 | 2 | 6% of 890 |
| Jun 2025 | 2 | 9% of 829 |
| Jul 2025 | 0 | 6% of 824 |
| Aug 2025 | 1 | 10% of 680 |
| Sep 2025 | 0 | 4% of 1,424 |
| Oct 2025 | 0 | 5% of 1,394 |
| Nov 2025 | 2 | 9% of 492 |
| Dec 2025 | 2 | 5% of 1,690 |
| Jan 2026 | 0 | 11% of 1,131 |
| Feb 2026 | 25 | 14% of 1,356 |
| Mar 2026 | 33 | 16% of 2,437 |
| Apr 2026 | 41 | 16% of 2,558 |
| May 2026 | 44 | 14% of 3,363 |
| Jun 2026 | 40 | 18% of 2,968 |
| Jul 2026 | 55 | 16% of 3,326 |
| Aug 2026 | 35 | 14% of 3,871 |
| Sep 2026* | 2 | 6% of 634 |
| Oct 2026 | 26 | – |
Note: Only 4%–18% of each month's advisories have been researched so far, so a short bar can mean little research rather than few AI-caused vulnerabilities.
* Sep 2026 is partial, so its bar is lighter.
Patterns
Who, where, and why: the AI tools involved, what went wrong, and where the vulnerable code lives.
AI tools
300 of 310 findings name the tool on every AI-assisted change. Gray bars show each tool's share of the 45,156 AI-marked commits in the same repositories and window.
Share of findingsShare of AI-marked commits
- Claude244 findings81%87%
- GitHub Copilot21 findings7.0%8.5%
- Cursor18 findings6.0%2.6%
- ChatGPT/Codex16 findings5.3%1.1%
- claude-flow1 finding0.3%0.4%
Why some tools look over-represented
Claude self-marks nearly every commit; GPT/Codex and Cursor usually leave no marker, so their commit shares are floors. A findings share above the commit share is an upper bound, not proof a tool writes worse code. Shares that match mean findings track usage.
Root causes
One root-cause category per finding.
Languages
Where the vulnerable code lives, including findings whose language is not yet recorded.
Repositories
Repositories with the most findings. Filter the full index by repository in Findings.
Featured findings
See the vulnerable code and fix: one recent example of each kind of AI contribution.
- When Nodemailer's address parser cannot read an address strictly, it scans the free text. A Claude-co-authored repair in 10.0.6 replaced the slow regular expression with a scanner whose two new probes still searched the rest of the value, so long headers could stall the event loop until 10.0.9 bounded them. Found by source analysis, not timing.
HighGHSA-V53P-9FQP-M79JSep 11, 2026nodemailer/nodemailer
TypeScriptClaudeIncomplete remediationResource abuse & availability - A Claude Code change added a local MCP tool that opened any absolute path, so a local client could probe which files exist and read handler names from them.
CVE-2026-113731Oct 21, 2026djust-org/djust
PythonClaudeDirect introductionPath & link handling - A2A Java let any caller read other callers' tasks; a Claude-co-authored change added task authorization only as an opt-in, so the default setup stayed open until 1.3.0.Final.
CVE-2026-111764Oct 20, 2026a2aproject/a2a-java
JavaClaudeFlawed AI-written codeAuthentication & access control - AI-written code exposed a Management API that fail-open authenticated an empty token and passed user input to shell exec, enabling remote OS command injection.
MediumCVE-2026-76761Aug 20, 2026chenhg5/cc-connect
GoClaudeNew attack surfaceInjection & unsafe execution - Codex- and OpenCode-assisted changes in Vitest 5 replaced Vite's default file deny list with a token-only list, so a running UI, API or Browser Mode server could serve .env files, keys and .git contents.
CVE-2026-112948Oct 21, 2026vitest-dev/vitest
TypeScriptChatGPT/CodexDirect introductionOther or unclear - The MCP TypeScript SDK followed redirects to any origin; a Claude Code change also attached transport custom headers to OAuth requests, so a redirecting authorization server could leak API keys.
CVE-2026-111769Oct 20, 2026modelcontextprotocol/typescript-sdk
TypeScriptClaudeFlawed AI-written codeSSRF & network boundaries
Media coverage
Q&A
- What counts as an AI-contributed vulnerability?
- The vulnerable behavior must depend on an AI-authored code change and be reversed by a real security fix.
- Is every AI-related commit shown?
- No. Each finding shows the contributing change and minimum fix, not unrelated search candidates.
- Is this the total number of AI security bugs?
- No. The index contains 310 findings, an observed public set rather than a census of every AI bug.
- Can a finding be corrected?
- Yes. Open a GitHub issue with the advisory, commit, or release evidence that changes the conclusion.