The security risk in detecting vibecoded apps
Threat actors could get a quick way to spot the apps most likely to have a hole in the backend nobody looked at.
Everyone's got an opinion on the EU AI Act. It's a privacy violation. It'll dampen model output. It'll push builders toward open-weight Chinese models that don't answer to the EU. Maybe all of that's true. But I rarely see people talking about a massive issue that affects people who rely on claude to 'vibecode'. Here's the truth. Everyone and their mother is vibecoding right now, and most people barely review what comes out the other end. If they care enough, they'll touch up the frontend so it doesn't look vibecoded. However, the backend almost never gets that treatment. Most people vibecoding don't actually know what is going on in the backend. Most don't check the auth logic or how queries get handled. They prefer to check whether the button gradient looks appealing enough.
Now let's think about this for one second. Anthropic is rolling out invisible watermarks on all Claude's text output, including through Claude Code, this already covers more ground than the EU Act actually requires. The Commission's own Article 50 guidance excludes source code from the marking obligation entirely. So Anthropic doing this to code is an active choice, not a legal mandate. And once public detection tooling for that mark exists, which Anthropic says is coming, anyone gets to run it, including someone hunting for apps where they can extract the user database in plaintext. (which feels like is the industry-standard nowadays)
You don't even need the official mark to make that judgement call today. The code already reads like what it is if nobody touched it after the model wrote it. But once there's an official, sanctioned way to confirm "this is AI output, probably untouched, and here's which model wrote it," threat actors get a quick way to spot exactly the apps most likely to have a hole in the backend nobody looked at.
That's already a problem on its own, and the data backs it up. OX Security found 62% of AI-built apps ship with critical vulnerabilities. A Q1 2026 review of more than 200 vibecoded apps found 91.5% had at least one bug traceable straight to AI hallucination. Nearly half fail OWASP Top-10 checks outright.
I wish this was brought up more often.