{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/arxiv-2512-03262","title":"Is Vibe Coding Safe? Benchmarking Vulnerability of Agent-Generated Code in Real-World Tasks","arxiv_id":"2512.03262","date":"2025-12-02","proceeding":"ICML","authors":["Songwen Zhao","Danqing Wang","Kexun Zhang","Jiaxuan Luo","Zhuo Li","Lei Li"],"abstract":"Vibe coding is a new software development paradigm in which human engineers prompt a large language model (LLM) agent to complete complex coding tasks with little supervision. Although vibe coding is increasingly adopted, is the generated code really safe to deploy in production? To investigate this question, we propose SUSVIBES, a benchmark consisting of 186 feature-request software engineering tasks from real-world open-source projects, for which, human programmers committed vulnerable implementations. We evaluate 12 widely used coding agentic settings with frontier models on the benchmark. Disturbingly, all agents perform poorly in terms of software security. Although 57% of the solutions from SWE-Agent with Claude 4 Sonnet are functionally correct, only 11.8% are secure. Further experiments demonstrate that preliminary security strategies, such as augmenting the feature request with vulnerability hints, cannot mitigate these security issues. Our findings raise serious concerns about the widespread adoption of vibe coding, particularly in security-sensitive applications. The code and dataset are available at https://github.com/LeiLiLab/susvibes. The leaderboard is at https://leililab.github.io/susvibes-leaderboard.","url_abs":"https://arxiv.org/abs/2512.03262","url_pdf":"https://arxiv.org/pdf/2512.03262","source":{"archive":null,"snapshot":"2025-07-28","note":"not in the Papers with Code archive (frozen at the snapshot)","row_kind":"graph","title_abstract_authors_date":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)"},"code_links":[],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":null,"atlas_url":"https://app.syntology.ai/?focus=2512.03262","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2512.03262"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/LeiLiLab/susvibes","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"unverified":11},"by_repo_kind":{"found_in_text":{"samples":11,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"17560aaa17bfb40d","entry":"clip_tokens","repo":"LeiLiLab/susvibes","repo_kind":"found_in_text","path":"susvibes/core/logs.py","file_url":"https://github.com/LeiLiLab/susvibes/blob/HEAD/susvibes/core/logs.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"17560aaa17bfb40d"}},{"code_sha256_prefix":"67db3fcd2134d45d","entry":"extract_json_object","repo":"LeiLiLab/susvibes","repo_kind":"found_in_text","path":"susvibes/core/logs.py","file_url":"https://github.com/LeiLiLab/susvibes/blob/HEAD/susvibes/core/logs.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"67db3fcd2134d45d"}},{"code_sha256_prefix":"860aa57230c924e2","entry":"get_agent_setting_path","repo":"LeiLiLab/susvibes","repo_kind":"found_in_text","path":"susvibes/curate/constants.py","file_url":"https://github.com/LeiLiLab/susvibes/blob/HEAD/susvibes/curate/constants.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"860aa57230c924e2"}},{"code_sha256_prefix":"87febe0057931286","entry":"get_dataset_path","repo":"LeiLiLab/susvibes","repo_kind":"found_in_text","path":"susvibes/core/constants.py","file_url":"https://github.com/LeiLiLab/susvibes/blob/HEAD/susvibes/core/constants.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"87febe0057931286"}},{"code_sha256_prefix":"82b747bd2d678cf7","entry":"get_log_dir","repo":"LeiLiLab/susvibes","repo_kind":"found_in_text","path":"susvibes/curate/constants.py","file_url":"https://github.com/LeiLiLab/susvibes/blob/HEAD/susvibes/curate/constants.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"82b747bd2d678cf7"}},{"code_sha256_prefix":"a2cf31f1159cc7d5","entry":"is_errored","repo":"LeiLiLab/susvibes","repo_kind":"found_in_text","path":"susvibes/core/report.py","file_url":"https://github.com/LeiLiLab/susvibes/blob/HEAD/susvibes/core/report.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a2cf31f1159cc7d5"}},{"code_sha256_prefix":"b43147f014c0715f","entry":"is_transient_error","repo":"LeiLiLab/susvibes","repo_kind":"found_in_text","path":"susvibes/core/agents/claude.py","file_url":"https://github.com/LeiLiLab/susvibes/blob/HEAD/susvibes/core/agents/claude.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b43147f014c0715f"}},{"code_sha256_prefix":"baf788c2a03567da","entry":"load_file","repo":"LeiLiLab/susvibes","repo_kind":"found_in_text","path":"susvibes/core/utils.py","file_url":"https://github.com/LeiLiLab/susvibes/blob/HEAD/susvibes/core/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"baf788c2a03567da"}},{"code_sha256_prefix":"0fe1071ca868cfee","entry":"push_dataset_to_hub","repo":"LeiLiLab/susvibes","repo_kind":"found_in_text","path":"susvibes/core/utils.py","file_url":"https://github.com/LeiLiLab/susvibes/blob/HEAD/susvibes/core/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"0fe1071ca868cfee"}},{"code_sha256_prefix":"bad5d7639938f5d4","entry":"strip_ansi","repo":"LeiLiLab/susvibes","repo_kind":"found_in_text","path":"susvibes/core/logs.py","file_url":"https://github.com/LeiLiLab/susvibes/blob/HEAD/susvibes/core/logs.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"bad5d7639938f5d4"}},{"code_sha256_prefix":"6a7e0f6595ea0e79","entry":"strip_bookkeeping","repo":"LeiLiLab/susvibes","repo_kind":"found_in_text","path":"susvibes/core/report.py","file_url":"https://github.com/LeiLiLab/susvibes/blob/HEAD/susvibes/core/report.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"6a7e0f6595ea0e79"}}]},"arxiv_metadata":{"licence":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)","fields":["title","abstract","authors","date"],"primary_category":"cs.SE","source":"arxiv_api"},"syntology_extracted_results":null}