Survey On Systemic Security Risks in Vibe Coding and Autonomous Development Workflows

The discipline of software engineering is currently going through a massive and sudden change toward what is being called "vibe coding." This is a new way of working where human developers stop being the ones who write every line of code. Instead, they become "managers of intent." They tell the computer what they want the result to feel like-the "vibe"-and leave the hard work of writing the code, finding errors, and running the program to autonomous Artificial Intelligence (AI) agents. While this new way of working promises to make building software much faster and allows more people to create programs, it also brings with it serious security risks that our traditional safety rules for software are not ready to handle. This research report synthesizes empirical studies, vulnerability reports, and technical analyses from late 2024 through 2025 to construct a comprehensive taxonomy of these emerging threats. The analysis identifies a critical ontological transition from "artifact-centric" risks to "agent-centric" risks, where the Integrated Development Environment (IDE) is weaponized against the developer. Key findings highlight the emergence of "Indirect Prompt Injection" (IPI), "Lies-in-the-Loop" (LITL) attacks, and the accumulation of "Security Debt" driven by LLM sycophancy. This report addresses gaps regarding the Model Context Protocol (MCP) and concludes by mapping these technical challenges to the regulatory landscape of the EU AI Act 2025.