Skip to content

How we verify

Evidence before attribution.

This public index covers 303 findings. Each case links its vulnerability, contributing change, AI signal, and closing fix back to first-party evidence.

Real disclosed vulnerabilities from Georgia Tech SSLab, not synthetic benchmarks.

From disclosure to a verified finding

Every finding passes four checks before it is published.

  1. Match the advisory. Confirm the advisory, repository, package, and vulnerability.
  2. Locate the AI-assisted change. Bind AI evidence to the exact commit and relevant code hunk.
  3. Prove cause and fix. Compare the parent, AI-assisted change, and minimum fix on the same attack path.
  4. Confirm the release. Verify the vulnerable and fixed releases, then remove true duplicates.

What the dataset means

What counts
AI introduced the flaw, exposed the vulnerable path, or left a security fix incomplete.
What does not count
An AI marker, Git blame, or model verdict alone. The code change must affect the same mechanism.
What we do not claim
This is not a census of every AI bug and does not compare AI and human defect rates.

Sources

Public and repository advisories identify disclosed vulnerabilities. Git history and released artifacts determine the AI contribution and each finding's verification status.

Cite and download

Every published finding is available as one CSV file with its identifiers, repository, AI tool, AI role, root cause and summary. To cite the dataset:

@misc{vibesecradar,
  title        = {Vibe Security Radar},
  author       = {{Georgia Tech SSLab}},
  howpublished = {\url{https://vibesecradar.com}},
  note         = {303 findings, data through 2026-09-26}
}

Corrections

Found a false positive? Email [email protected] with the advisory, commit, or release evidence that changes the conclusion.