AI-Generated Code CVEs Hit 35 in March. That's 6x January's Count, and the Trend Line Isn't Flattening.

Six CVEs traced to AI-generated code in January. Fifteen in February. Thirty-five in March. Infosecurity Magazine reports the numbers, tracked by Georgia Tech's SSLab through their "Vibe Security Radar" project running since May 2025. The acceleration is clear and there's no sign it's slowing down.

The CVE surge doesn't exist in isolation. Security researchers analyzed over 30,000 MCP skills, the integrations connecting AI agents to external tools, and found more than 25% contained at least one vulnerability (Dark Reading). That's the agent-tool integration surface expanding faster than anyone can audit it. OpenClaw, the open-source agent runtime at 210K+ GitHub stars, had 9 CVEs disclosed in 4 days between March 18-21. One was a 9.9 CVSS critical where authenticated users could self-declare admin scopes during WebSocket handshake. The tracker now lists 156 total security advisories with 128 still awaiting CVE assignment.

I keep hearing "ship faster with AI" as if speed is free. It's not. We're generating code at a pace that outstrips our ability to review it, and the vulnerabilities are accumulating in the exact places where agents connect to the real world: file systems, network requests, authentication flows, and tool integrations. The MCP ecosystem has none of the security infrastructure that took npm and PyPI a decade to build. No lockfiles for skills. No signature verification. No vulnerability scanning in the install path.

What to do right now: treat AI-generated code like untrusted third-party contributions. Run static analysis before merge, not after deployment. If you're using MCP skills, audit every one that touches your filesystem or makes network requests. And if you're building MCP skills, you're now a supply chain participant for 210K+ developers. Act like it.