Search papers, labs, and topics across Lattice.
The paper introduces VibeGuard, a security gate framework designed to address vulnerabilities arising from the increasing use of AI-generated code in production, specifically targeting blind spots like artifact hygiene and source-map exposure. VibeGuard employs a suite of checks tailored to detect these AI-introduced vulnerabilities before publication. Experiments on synthetic projects demonstrate VibeGuard's effectiveness, achieving 100% recall and 89.47% precision in identifying vulnerabilities, suggesting it can reliably prevent AI-driven code leaks.
AI-generated code is shipping with critical vulnerabilities that existing security tools miss, but VibeGuard catches them with high precision and recall.
"Vibe coding," in which developers delegate code generation to AI assistants and accept the output with little manual review, has gained rapid adoption in production settings. On March 31, 2026, Anthropic's Claude Code CLI shipped a 59.8 MB source map file in its npm package, exposing roughly 512,000 lines of proprietary TypeScript. The tool had itself been largely vibe-coded, and the leak traced to a misconfigured packaging rule rather than a logic bug. Existing static-analysis and secret-scanning tools did not cover this failure mode, pointing to a gap between the vulnerabilities AI tends to introduce and the vulnerabilities current tooling is built to find. We present VibeGuard, a pre-publish security gate that targets five such blind spots: artifact hygiene, packaging-configuration drift, source-map exposure, hardcoded secrets, and supply-chain risk. In controlled experiments on eight synthetic projects (seven vulnerable, one clean control), VibeGuard achieved 100% recall, 89.47% precision (F1 = 94.44%), and correct pass/fail gate decisions on all eight projects across three policy levels. We discuss how these results inform a defense-in-depth workflow for teams that rely on AI code generation.
