VibeGuard 为 AI 生成代码设计安全门，防止漏发敏感文件和配置错误。
VibeGuard: A Security Gate Framework for AI-Generated Code
- 通过检测打包配置漂移、源码映射暴露等五类 AI 代码漏洞，构建发布前安全检查
- 在 8 个模拟项目中实现 100% 漏洞检出率，准确率 89.47%，F1 达 94.44%
- 适合依赖 AI 生成代码的团队，提升安全防护深度
开发者将代码生成任务交由 AI 助手并少加人工审查的‘Vibe coding’模式在生产环境中迅速普及。2026 年 3 月 31 日，Anthropic 的 Claude Code CLI 在其 npm 包中意外包含一个 59.8 MB 的源码映射文件，暴露约 51.2 万行专有 TypeScript 代码。该工具本身主要通过 Vibe coding 实现，泄露源于打包配置错误而非逻辑漏洞。现有静态分析与密钥扫描工具未能覆盖此类风险，暴露出当前工具对 AI 引入漏洞的检测盲区。本文提出 VibeGuard——一种针对五大盲点（构件卫生、打包配置漂移、源码映射暴露、硬编码密钥、供应链风险）的预发布安全门。在八个合成项目（七例含漏洞，一例为干净对照）上，VibeGuard 达到 100% 召回率、89.47% 精确率（F1=94.44%），并在三个策略层级下正确判断所有项目的通过/失败。研究结果为依赖 AI 代码生成的团队提供了纵深防御工作流参考。
原文摘要 · Abstract (English)
"Vibe coding," in which developers delegate code generation to AI assistants and accept the output with little manual review, has gained rapid adoption in production settings. On March 31, 2026, Anthropic's Claude Code CLI shipped a 59.8 MB source map file in its npm package, exposing roughly 512,000 lines of proprietary TypeScript. The tool had itself been largely vibe-coded, and the leak traced to a misconfigured packaging rule rather than a logic bug. Existing static-analysis and secret-scanning tools did not cover this failure mode, pointing to a gap between the vulnerabilities AI tends to introduce and the vulnerabilities current tooling is built to find. We present VibeGuard, a pre-publish security gate that targets five such blind spots: artifact hygiene, packaging-configuration drift, source-map exposure, hardcoded secrets, and supply-chain risk. In controlled experiments on eight synthetic projects (seven vulnerable, one clean control), VibeGuard achieved 100% recall, 89.47% precision (F1 = 94.44%), and correct pass/fail gate decisions on all eight projects across three policy levels. We discuss how these results inform a defense-in-depth workflow for teams that rely on AI code generation.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。