Georgia Tech SSLab · Security research
Vibe Security Radar
303 AI-contributed vulnerabilities cataloged and evidence-linked across their full causal chain.
- Findings
- 303
- AI-contributed vulnerabilities
- Covered advisories
- 30,377
- May 2025 – Sep 2026
- Fully researched
- 3,770
- 12% of covered advisories so far
- Projects
- 133
- Most represented project: openclaw/openclaw
Findings per month
Full trend ↓65
May 2025Peak advisory month: Jul 2026Sep 2026
AI tools
vs. commits ↓
Claude82%
GitHub Copilot7.5%
ChatGPT/Codex5.4%
Cursor4.8%
Most common AI tool among findings that name one.
Disclosures over time
303 findings by advisory publication month, May 2025 – Sep 2026. Data through Sep 26, 2026.
Only 4%–18% of each month's advisories have been researched so far, so a short bar can mean little research rather than few AI-caused vulnerabilities.
Findings per monthHover or tap a month for details
| Month | Findings | Advisories researched |
|---|---|---|
| May 2025 | 2 | 6% of 890 |
| Jun 2025 | 2 | 9% of 829 |
| Jul 2025 | 0 | 6% of 824 |
| Aug 2025 | 1 | 10% of 680 |
| Sep 2025 | 0 | 4% of 1,424 |
| Oct 2025 | 0 | 5% of 1,394 |
| Nov 2025 | 2 | 9% of 492 |
| Dec 2025 | 2 | 5% of 1,690 |
| Jan 2026 | 0 | 11% of 1,131 |
| Feb 2026 | 27 | 14% of 1,356 |
| Mar 2026 | 34 | 16% of 2,437 |
| Apr 2026 | 43 | 16% of 2,558 |
| May 2026 | 47 | 14% of 3,363 |
| Jun 2026 | 40 | 18% of 2,968 |
| Jul 2026 | 65 | 16% of 3,326 |
| Aug 2026 | 36 | 14% of 3,871 |
| Sep 2026* | 2 | 5% of 629 |
* Sep 2026 is partial, so its bar is lighter.
Patterns
Who, where, and why
AI tools
294 of 303 findings name the tool on every AI-assisted change. Gray bars show each tool's share of the 45,156 AI-marked commits in the same repositories and window.
Share of findingsShare of AI-marked commits
- Claude241 findings82%87%
- GitHub Copilot22 findings7.5%8.5%
- ChatGPT/Codex16 findings5.4%1.1%
- Cursor14 findings4.8%2.6%
- claude-flow1 finding0.3%0.4%
Why some tools look over-represented
Claude self-marks nearly every commit; GPT/Codex and Cursor usually leave no marker, so their commit shares are floors. A findings share above the commit share is an upper bound, not proof a tool writes worse code. Shares that match mean findings track usage.
Root causes
One root-cause category per finding.
Languages
Where the vulnerable code lives, including findings whose language is not yet recorded.
Repositories
Repositories with the most findings. Filter the full index by repository in Findings.
Featured findings
See the vulnerable code and fix
Claude · nodemailer/nodemailer2026-09-11When Nodemailer's address parser cannot read an address strictly, it scans the free text. A Claude-co-authored repair in 10.0.6 replaced the slow regular expression with a scanner whose two new probes still searched the rest of the value, so long headers could stall the event loop until 10.0.9 bounded them. Found by source analysis, not timing.
Incomplete remediationResource abuse & availability
GHSA-V53P-9FQP-M79JRoot cause and fix →
Claude · nodemailer/nodemailer2026-09-11Nodemailer's address parser appends each address part to one growing string. A Claude-co-authored change in 9.1.0 reads that string's last character before every append, which V8 can turn into a copy of the whole string, so comment-separated addresses parse in quadratic time. Mailparser feeds inbound headers here. Release 10.0.5 caches the last character.
Direct introductionResource abuse & availability
CVE-2026-90776Root cause and fix →
AI-assisted; tool not identified · mervinpraison/praisonai2026-08-25PraisonAI added an agent-invocation route without enforcing the configured API key. The repair installs shared authentication middleware on the application.
Flawed AI-written codeAuthentication & access control
CVE-2026-55538Root cause and fix →
Claude · chenhg5/cc-connect2026-08-20AI-written code exposed a Management API that fail-open authenticated an empty token and passed user input to shell exec, enabling remote OS command injection.
New attack surfaceInjection & unsafe execution
CVE-2026-76761Root cause and fix →
Claude · mervinpraison/praisonai2026-08-25PraisonAI checked literal IP addresses without resolving ordinary hostnames before Spider requests. The repair checks DNS results for blocked addresses and rejects resolution failures.
Direct introductionSSRF & network boundaries
CVE-2026-55526Root cause and fix →
Cursor · lin-snow/ech02026-08-25AI-assisted scope hardening on the user-list route left ordinary sessions exempt from capability checks and relied on an administrator check that the existing service did not perform. The exposure predated that hardening. Other dashboard routes and the separate WebSocket log path also lack required role authorization, but those independent omissions are not attributed to this change. Version 4.5.1 adds an administrator check for user listing only. Dashboard and log-stream exposure remains in the inspected source revision; no complete advisory repair or binary equivalence is established.
Flawed AI-written codeAuthentication & access control
CVE-2026-79665Root cause and fix →
Media coverage
Q&A
- What counts as an AI-contributed vulnerability?
- The vulnerable behavior must depend on an AI-authored code change and be reversed by a real security fix.
- Is every AI-related commit shown?
- No. Each finding shows the contributing change and minimum fix, not unrelated search candidates.
- Is this the total number of AI security bugs?
- No. The index contains 303 findings, an observed public set rather than a census of every AI bug.
- Can a finding be corrected?
- Yes. Open a GitHub issue with the advisory, commit, or release evidence that changes the conclusion.