84% of Russian Mobile Apps Contain Critical Vulnerabilities — and the Number Keeps Growing

84% of Russian mobile apps contain critical vulnerabilities. Their combined number has passed into the tens of thousands, and it keeps growing every year. Developers are in no hurry to fix them, while the spread of AI coding is becoming an additional, poorly controlled source of new "holes."

Nine out of ten apps are insecure

Analysts surveyed the Russian mobile app market and reached a disheartening conclusion: 84% of products contain critical vulnerabilities. That means only about one app in seven can be considered reasonably secure; the rest pose a potential risk to their users.

Across the market, the problem amounts to tens of thousands of "holes." The trend is steadily negative: the number of vulnerabilities grows year over year rather than shrinking.

Russian users work every day with banking services, government service apps, marketplaces and messengers that contain unpatched flaws. Attackers can use these flaws to gain access to personal data, correspondence and financial transactions.

AI coding as a source of risk

The spread of AI tools in development is cited as one of the key factors behind the growth. Neural networks have sped up code production: apps are built faster and in greater volume than before. But speed runs directly against security.

Generative models are trained on huge volumes of code from open repositories, including code that contains common vulnerabilities. By reproducing familiar patterns, a neural network can automatically carry long-known security problems into a new project. The code looks functional on the surface and passes basic tests, yet the vulnerability stays hidden until the first real attack.

The specific ways AI coding creates risk:

• neural networks reproduce patterns from public code, including vulnerable code
• developers accept generated code without a thorough security review
• development speed cuts the time available for security checks
• the volume of generated code outpaces the capacity of manual audits

The more heavily teams rely on AI generation without follow-up review, the higher the chance that the next app ends up among those 84%.

Vulnerabilities go unfixed for years

The more acute problem may not be the emergence of new vulnerabilities but the failure to fix existing ones. Discovered "holes" stay open for long periods: app owners either don't know about specific problems or don't consider them a priority amid competitive pressure and tight deadlines.

A mandatory security audit before an app is published is not yet standard practice. As a result, attackers who know about a vulnerability in a particular service can exploit it for months, without any technical or legal obstacles.

Medical services, financial platforms and corporate tools are of particular concern: they are the most frequent targets of focused attacks.

What this means

The picture is alarming: eight in ten apps are insecure, vulnerabilities multiply every year, and those responsible for fixing them are in no hurry. AI development without built-in security practices only speeds up the accumulation of problems.

For end users, the advice is pragmatic: limit app permissions to the necessary minimum, update apps regularly and delete programs you no longer use.