A new generation of software is being written almost entirely by AI, and it is landing on app stores at speed. The practice, known as vibe coding, lets people describe an idea in plain language and accept the code an AI tool produces, often with little or no review. That convenience comes with a sharp edge: when the developer cannot spot bugs, you become the last line of defense.
According to welivesecurity.com, the term was only coined in February 2025, yet within months a reported 84% of developers had already adopted AI helpers or intended to bring them into their workflow. Cybersecurity news coverage is now catching up, because threat intelligence researchers keep finding real weaknesses in apps built this way.
What "vibe coding" actually means
Vibe coding describes a workflow where a person tells an AI what the software should do, then ships whatever code the assistant generates. The human role leans toward ideas and aesthetics rather than reviewing every function. Lowering the technical barrier is the point, and it works: complete newcomers can now publish applications that look polished and feel modern. The trade-off is that quality control, security testing and careful coding can quietly fall through the cracks. Tools designed for vibe coding tend to favor look-and-feel and quick results over hardening, and the storefronts hosting these apps do not always catch what slips past.
Where the real dangers hide
Reported incidents show the concern is not theoretical. welivesecurity.com highlights a security researcher who found 16 vulnerabilities inside a single app built on the Lovable vibe coding platform. Six of those flaws were reportedly rated critical and exposed sensitive user information, even though the app had already attracted more than 100,000 views. Lovable said the issues were fixed afterward.
Two threat categories deserve attention for anyone following antivirus and threat intelligence news:
- Prompt injection, where attackers hide malicious instructions inside prompts or in web content that the AI later reads. If the tool can reach your private data or accounts, those hidden instructions may steer it in dangerous directions.
- Rookie coding mistakes, including weak or no encryption, hard-coded secrets, sloppy input handling, broken authentication and direct leaks from developer servers.
The downstream impact is what most readers actually feel: data loss, financial exposure and silent malware installation.
What it means for you
If you install software for work, school or daily life, the app store badge is no longer enough. Marketplaces differ widely in how carefully they vet listings, and a clean install screen says nothing about how the code was written. A few targeted questions separate a reasonable bet from a gamble:
- Who built it, and can you verify their identity and history?
- What do reviews say, and do they describe real, sustained use?
- Which permissions does it request, and do they match the app's purpose?
- Does the privacy policy clearly explain what data is stored and where?
- What can the AI features reach inside your accounts, files or device?
Treat unknown or unreviewed apps the same way you treat unfamiliar email attachments: assume risk until proven otherwise.
Five practical checks before you download
Run through this short list before tapping install, especially for free utilities, AI helpers and brand-new publishers:
- Search the developer's name plus "breach," "scam" or "review" to surface independent opinions.
- Read the permission list; a flashlight app should never need contacts, microphone or location.
- Skim the privacy policy for data retention periods, third-party sharing and server locations.
- Confirm there is a working support channel and a real entity behind the product.
- Prefer platforms with mandatory code signing, transparent review processes and quick takedowns.
If you already installed a risky app
Containment matters more than panic. welivesecurity.com outlines a sensible cleanup path that also serves as good general hygiene:
- Change the app's password, then ask for full account deletion; uninstalling alone does not erase stored data.
- Reset every reused password on any other service that shared it, and switch on multi-factor protection everywhere it is offered.
- Revoke linked logins such as Google or Apple single sign-on so the app can no longer piggyback on those identities.
- Watch bank, credit and identity accounts for unfamiliar activity.
- If the app itself looks malicious, uninstall it, run a trusted antivirus scan on Android, and consider a factory reset if the threat persists. Make all password resets from a different, clean device.
Key takeaways
- AI-built apps are mainstream, but their developers often skip the security steps that seasoned engineers treat as standard.
- Marketplace listing is not a safety guarantee; always check the developer, permissions, privacy policy and AI access scope.
- If something feels off after installation, reset passwords, revoke connected accounts and enable multi-factor authentication immediately.
Frequently asked questions
What is vibe coding in simple terms?
It is a way of building software by describing what you want to an AI tool in everyday language and then accepting the code it generates, usually with little manual review.
Can I tell whether an app was built with AI?
Usually not from the outside alone, so it is better to judge the product by its developer reputation, permissions, privacy policy and security design rather than its origin story.
Are AI-built apps always unsafe?
No. Safety depends on the developer's skill and the platform hosting the app, but novice builders may overlook weaknesses that put your data at risk.
What is prompt injection and why should I care?
It is an attack where hidden instructions are slipped into prompts or web content so an AI tool follows them. If that AI can reach your private data or accounts, the attacker may be able to steer it.
What is the fastest way to respond after installing a suspicious app?
Change its password, request account deletion, uninstall it, reset reused passwords elsewhere, turn on multi-factor authentication, revoke connected sign-ins and scan your device with trusted security software.
Source: welivesecurity.com