Insecure Vibe Coding: When AI Writes Exploitable Software - Sana Talwar - NDC Oslo 2026

Value of the Information & Strength of the Argument

The talk provides concrete, reproducible examples of how AI-generated code can fail security requirements. The argumentation is solid, built around three live demos that illustrate common pitfalls: missing expiry validation, encoding-based SQL injection, and cryptographic misuse. Each vulnerability is traced back to a reasonable-looking prompt, showing that the issue lies not in malicious intent but in the absence of explicit security constraints. The value is high for developers using AI assistants, as it equips them with specific patterns to look for. The argumentation could be strengthened by acknowledging that these are simplified examples, but it effectively bridges the gap between functional and secure coding.

Scientific Rigor, Source Quality, Title Accuracy

The talk draws on industry-standard references: OWASP guidelines for password storage (recommending Argon2) and VeraCode’s 2026 testing showing only 55% of AI-generated code is secure without explicit security guidance. However, these references are mentioned in passing without direct URLs or detailed data. The title is accurate and engaging. The content is consistent with the description, and the three demos are well-structured. While the talk doesn’t provide a formal literature review, it offers practical, immediately applicable security checks. The lack of explicit citations slightly reduces the rigor, but the use of well-known standards compensates.

The title accurately reflects the content: an examination of vulnerabilities in AI-generated code with live demonstrations.

7/10

The talk is a practical, demo-driven session by a security engineer. It references OWASP recommendations and VeraCode research, but lacks formal citations or peer-reviewed sources. The examples are realistic and actionable, but the reliability is moderate.

Markers derived by PSI from the transcript: the creator did not define chapters.

• 00:00Introduction and setup: talk overview and the 'Confetti Club' app
• 04:00Explanation of vibe coding loop and why AI code passes functional checks but fails security
• 10:00JWT expiration bug demo: expired token accepted due to disabled expiration verification
• 19:00SQL injection demo: URL-encoded payload bypasses validation, leading to injection
• 28:00Password hashing demo: SHA-256 cracking vs Argon2 with timing comparison
• 37:00Conclusion: pattern of missing security properties, checklist and prompt improvements

• NDC Conferences — Conference website where the talk was recorded, providing context for the event.
• NDC Oslo — Specific conference site for NDC Oslo, where the talk took place.

• OWASP — OWASP provides widely-accepted security standards and recommendations that align with the talk's advice on parameterized queries and password storage.

• ndcoslo.com