Skip to content

VSRVibe Security Radar

Findings Trends How we verify

Loading case details…

Vibe Security Radar

A mechanism-level study of vulnerabilities contributed by AI-written code. Each finding connects an advisory to the relevant change, residual vulnerability, and security fix.

Sources: first-party security advisories · public Git history · release artifacts

Data through Sep 26, 2026

By AI tool

Claude
GitHub Copilot
Cursor
ChatGPT/Codex

By root cause

Authentication & access control
Injection & unsafe execution
SSRF & network boundaries
Path & link handling
Validation & fail-open logic
Resource abuse & availability

Project

GitHub Data (CSV)Atom feed Contact

Findings/Root cause/Validation & fail-open logic

Validation & fail-open logic in AI-generated code

A security validator, denylist, signature, or schema check is incomplete, incorrectly ordered, or allows processing after validation cannot be established. 21 published CVEs and GitHub advisories in this category trace back to an AI-assisted code change, across 16 projects.

Findings: 21; 7% of all 284
Projects: 16; Most: openclaw/openclaw (3)
Critical or high: 8; of 11 with a severity score
Latest advisory: Aug 8, 2026; Data through Sep 26, 2026

Search and filter these findings →

Findings per month

5

May 2025Peak advisory month: Jul 2026Sep 2026

By advisory publication month. The latest month is partial.

AI tools

Which AI tool made the contributing change.

Claude17
ChatGPT/Codex2
Cursor1
Unidentified AI tool1

How AI contributed

Whether the AI-assisted change introduced the flaw, widened exposure, or left a fix incomplete.

Direct introduction11
New attack surface4
Flawed AI-written code3
Incomplete remediation3

Languages

Primary language of the affected repository.

Python5
TypeScript5
JavaScript4
Go2
PHP2
Ruby2

All 21 findings

Newest first

AI-written journey storage code joined unvalidated journeyId values into filesystem paths, letting ../ traverse out of ~/.ui-probe/journeys to read or delete arbitrary files.
CVE-2026-19270Aug 8, 2026hulupeep/mcp-ui-probeTypeScriptClaudeDirect introductionValidation & fail-open logic
Claude-assisted automation code sent server-side POST requests to account-supplied URLs without the existing SSRF destination check. The direct fix blocks private and reserved targets and redirect bounces before the request.
CVE-2026-67530Jul 30, 2026arnasdon/wacrmTypeScriptClaudeDirect introductionValidation & fail-open logic
An AI-assisted change stopped environment expansion on clone URLs but left the same expansion in the remote and submodule callers, so a URL passed to create_remote or add could embed the hosting process's secrets and carry them to the attacker's host.
CVE-2026-73622Jul 24, 2026gitpython-developers/gitpythonPythonChatGPT/CodexIncomplete remediationValidation & fail-open logic
AI-written signing code omitted replay protections like counters or timestamps, letting attackers reinstall stale signed policies and bypass current security rules.
CVE-2026-47133Jul 20, 2026craigjbass/clearancekitSwiftClaudeDirect introductionValidation & fail-open logic
AI-written code in StoreUserRequest failed to validate the role field and skipped admin authorization, letting any authenticated user mass-assign the Admin role and escalate privileges.
MediumCVE-2026-63102Jul 20, 2026rconfig/rconfigPHPClaudeNew attack surfaceValidation & fail-open logic
Claude-generated validation endpoints accepted read-only API tokens but performed write-scoped provider actions, letting those tokens trigger changes.
CVE-2026-32718Jul 6, 2026coollabsio/coolifyPHPClaudeNew attack surfaceValidation & fail-open logic
A change co-authored by Claude Code introduced the flaw in Gogs by adding a shortcut to LocalStorage.Upload that skips hashing the uploaded body when an LFS object's file already exists, letting a writer who knows another repository's OID bind it and download the original bytes.
HighCVE-2026-52812Jun 23, 2026gogs/gogsGoClaudeDirect introductionValidation & fail-open logic
Claude Code wrote the restricted-builtins sandbox, but the vulnerable behavior already existed in earlier human-written code that ran with full builtins; the AI change left the dunder read open.
MediumCVE-2026-57120Jun 18, 2026mervinpraison/praisonaiPythonCursorFlawed AI-written codeValidation & fail-open logic
A Claude-assisted hardening change sanitized the security context of Fission Environment pod specs but not their separate container fields, so tenants could still request privileged containers through those fields.
CVE-2026-50566Jun 10, 2026fission/fissionGoClaudeFlawed AI-written codeValidation & fail-open logic
Claude-assisted vm2 hardening rejected only one literal option pair. Other values still built a resolver that exposed vm2 inside the sandbox, letting untrusted code create a nested NodeVM with access to host modules.
CriticalCVE-2026-47137May 29, 2026patriksimek/vm2JavaScriptClaudeIncomplete remediationValidation & fail-open logic
In n8n-MCP, the AI-written workflow telemetry sanitizer incorrectly allowed partial values from URL-shaped node parameters to persist in telemetry events, potentially leaking sensitive data.
CVE-2026-45582May 18, 2026czlonkowski/n8n-mcpTypeScriptClaudeIncomplete remediationValidation & fail-open logic
GitPython validated configuration values but left section and option names unchecked. The repair rejects carriage returns, newlines and NUL characters in configuration names.
HighCVE-2026-67326May 6, 2026gitpython-developers/gitpythonPythonChatGPT/CodexFlawed AI-written codeValidation & fail-open logic
A change co-authored by Claude Opus 4.6 introduced the approval-resolution endpoints that write the client-supplied decidedByUserId into the approval's decider field, enabling attribution forgery.
GHSA-P7MM-R948-4Q3QApr 16, 2026paperclipai/paperclipTypeScriptClaudeDirect introductionValidation & fail-open logic
The AI-written broadcaster only treats REJECTED and DOUBLE_SPEND_ATTEMPTED as failures, so invalid, malformed, or stale ARC responses are silently accepted as successful broadcasts.
HighCVE-2026-40069Apr 9, 2026sgbett/bsv-ruby-sdkRubyClaudeDirect introductionValidation & fail-open logic
A Claude-assisted change added certificate acquisition that stored certificates without verifying the certifier's signature, so forged certificates could be stored and later presented as trusted.
HighCVE-2026-40070Apr 9, 2026sgbett/bsv-ruby-sdkRubyClaudeDirect introductionValidation & fail-open logic
AI-written code allowed Feishu webhook deployments with only verificationToken to accept forged events, enabling unauthenticated injection.
HighCVE-2026-32974Mar 13, 2026openclaw/openclawJavaScriptClaudeNew attack surfaceValidation & fail-open logic
A change written with Claude Code introduced the fail-open checkUserAllowed helper, its webhook gate and the empty allowlist default that let any token-bearing sender reach agent dispatch.
CVE-2026-31998Mar 3, 2026openclaw/openclawTypeScriptClaudeDirect introductionValidation & fail-open logic
OpenClaw's AI-written cleanup code killed processes by command-line pattern without ownership checks, letting shared-host users terminate unrelated processes.
MediumCVE-2026-27486Feb 18, 2026openclaw/openclawJavaScriptClaudeNew attack surfaceValidation & fail-open logic
openssl_encrypt accepted metadata without schema validation when jsonschema was unavailable. The repair raises a validation error instead of treating the missing dependency as a successful check.
CriticalCVE-2026-74875Feb 10, 2026jahlives/openssl_encryptPythonClaudeDirect introductionValidation & fail-open logic
Claude-generated plugin guards omitted dangerous Python modules. A plugin that bypassed the static scan could import them and escape the sandbox.
CVE-2026-74886Feb 10, 2026jahlives/openssl_encryptPythonClaudeDirect introductionValidation & fail-open logic
Google Jules-created backend code trusted unverified PayPal webhook bodies, so attackers could mark purchases complete without a valid PayPal signature.
CriticalGHSA-8G98-M4J9-QWW5Jun 18, 2025tailot/tayloredJavaScriptUnidentified AI toolDirect introductionValidation & fail-open logic