Vibe Coding: A Pentester’s Dream

Melissa Miller

Abstract:

As AI-assisted coding tools become increasingly embedded in developers’ workflows, what happens when an entire application is “vibe coded” – i.e., built primarily via prompts in an AI-enabled IDE? In this talk, I’ll walk through a real experiment in which we constructed a full web application using only AI-driven prompts, then challenged it with successive rounds of AI-enabled security audits and a final manual penetration test.
The results of the experiment could be a prediction of security trends as we see more code created by AI.

You’ll hear how the AI-generated application fared across four key dimensions of security: authentication (weak password handling and session issues), authorization (broken access controls and privilege escalation paths), data validation (insufficient sanitization and injection risks), and configuration (insecure defaults and missing security headers). Along the way, we’ll see how AI often prioritizes functionality over safety, creating patterns that look correct on the surface but crumble when compared to modern security standards.

Key takeaways include:
Why authorization and business logic vulnerabilities are likely to increase in AI-generated apps
How AI-driven audits can catch many issues but also introduce conflicting suggestions
The indispensable role of human pentesters – especially for nuanced, context-specific security testing
Strategies for developers, tool makers, and testers to keep pace in this evolving landscape

Melissa Miller

M’lissa *tips hat*

As a Director of Technical Enablement at NetSPI, Melissa’s current role consists of instructing NetSPI University students (a training program for those new to penetration testing), designing and presenting training across the organization, and overseeing the performance of web application pentests. In addition to web application testing, she has background in in social engineering, cloud, and network testing. She has her BSc in Computer Science from the University of Minnesota as well as OSCP and CEH certifications. In her free time, she can be found playing puzzle or logic-based games such as “Outer Wilds” and “Return of the Obra Dinn,” her recent favorites.