A Peer-Reviewed Paper Says Coding Agents Left Most Correct Solutions Vulnerable on Its Benchmark

A paper in the proceedings of the International Conference on Machine Learning, ICML 2026, tests what coding agents build when they are asked for a new feature. Its question is whether that code is safe to deploy in production. The paper is Is Vibe Coding Safe? Benchmarking Vulnerability of Agent-Generated Code in Real-World Tasks. On its own benchmark, it finds that agents "frequently achieve functional correctness yet fail security checks." Parts of the paper follow, not the whole.

The Tasks and the Two Sets of Tests

The paper describes vibe coding as a way of building software in which users work primarily by describing their goals in natural language to a large language model. They do so with minimal review of the generated code. The paper's benchmark, SusVibes, holds 186 feature-request tasks from real open-source projects. For each of them, human programmers had committed a vulnerable implementation. The tasks cover 79 weakness categories from the Common Weakness Enumeration.

Each task asks an agent to add a feature to a code repository. The description gives only the desired functionality, with no implementation details or security guidance. The agent can run its code and use the feedback to revise it. Its patch is then tested with two sets of human-written tests. One set checks functional correctness. The other checks security.

What the Tests Found

The paper tested 12 settings: three agent frameworks, each with four frontier models. The best functionally performing setting resolved 57% of the tasks. Yet 79.3% of its functionally correct solutions were insecure, the paper says. Of all that setting's solutions, only 11.8% were both correct and secure.

This indicates, the paper says, that if vibe coding users accept a solution after it passes functional tests, around 80% of the time the solution will leave security vulnerabilities in the repository.

The functional tests passed, and they were right to pass. They were never asked about security, so their green said nothing about it.

Two Fixes Tried

In its previous experiments, the paper had added a lightweight, generic security prompt that reminds agents to consider security. It then tried two more strategies on one setting. In one, the agent first identifies the potential security risk before it implements the feature. In the other, the agent is given the task's target security risk.

Both strategies slightly increased the number of secure solutions, the paper says. But the improvement came at the cost of lower functional correctness. And it did not substantially mitigate the security problem.

The Paper's Caution, and Its Limits

The paper's conclusion cautions against the casual adoption of vibe coding in security-sensitive contexts. It calls for better security strategies in current coding agents.

It also states its limits. The benchmark currently emphasizes Python ecosystems. It uses test outcomes as a practical proxy for security, and its annotations and tests "may be insufficient," the paper says. It does not claim coverage of all exploit modalities.