At .debug 2026, one of Croatia’s largest developer conferences, I introduced the concept of Ambient Generative IT – a coined term describing the phenomenon where AI-assisted development becomes so pervasive that it blends into the organizational fabric, much like ambient lighting blends into a room.
The word “ambient” comes from the Latin ambire (to surround), describing something seamlessly integrated with its environment.
This shift is already happening across organizations: marketing managers build internal dashboards, HR teams automate onboarding workflows, and sales ops create CRM integrations. None of them are engineers, and most have never heard of row-level security – yet they are all becoming software developers and publishers.
The question was straightforward: how do we securely enable a future where anyone can build enterprise-grade tools while still upholding the non-functional requirements we expect from professional software engineering, such as security, performance, scalability, and maintainability?
Everyone wants to build software now… #
There are two fundamental reasons why ambient generative IT is so appealing:
There have always been more consumers than producers.The demand for applications, integrations, automations, and digitalization has always exceeded what IT departments can deliver. That imbalance created Shadow IT decades ago, when the migration from mainframes to personal computers gave people the freedom to buy their own software. Cloud computing exploded it further. People want to be productive, and when the engineering bottleneck is too tight, they become their own builders.- The****thrill of creation. Every engineer remembers the first time they made a computer do something it would not do on its own. For non-technical employees experiencing vibe coding for the first time, that feeling is brand new and equally (if not more) intoxicating.
Shadow IT was the warning. Shadow AI is the crisis. #
Shadow IT is not new. Gartner estimates that 88% of organizations have experienced it, with the average company running 1,220 unauthorized cloud services while believing the number is just 91. By 2027, 75% of employees will acquire or create technology outside IT’s visibility.
But Shadow AI has accelerated the problem beyond anything Shadow IT ever produced.
According to IBM’s 2025 Cost of a Data Breach Report, shadow AI was involved in 20% of all breaches. This was more than sanctioned AI incidents (13%). Organizations with high levels of shadow AI paid an average of $4.74 million per breach, compared to $4.07 million for those with low or no shadow AI; a $670,000 premium. Perhaps most alarming: 97% of organizations that experienced an AI-related breach lacked proper AI access controls, and 63% had no AI governance policies at all.
Anyone from your company at any moment can generate an app, and this is not going through any development cycle or any security check. People can just start using it in production without asking anyone. And they do.
Dor Zvi, RedAccess
More than 380,000 exposed apps #
Israeli cybersecurity firm RedAccess discovered 380,000 publicly accessible applications built with vibe-coding tools like Lovable, Replit, Base44, and Netlify. Out of those, around 5,000 had virtually no security or authentication and about 40% exposed sensitive data.
WIRED independently verified the findings, confirming exposed hospital schedules with physician PII, go-to-market strategy presentations, complete customer service chatbot logs, and shipping cargo records.
Separately, Escape.tech scanned 5,600 vibe-coded applications and found over 2,000 critical vulnerabilities, 400+ exposed API keys, and 175 instances of personal data exposure in live production systems. Their methodology was deliberately conservative: it included passive scanning only, educational and healthcare domains excluded.
The actual exposure is likely far worse.
Gartner’s “Predicts 2026” report forecasts that by 2028, prompt-to-app approaches adopted by citizen developers will increase software defects by 2,500%.
The anatomy of a vibe-coded breach #
The pattern is remarkably consistent. For example, the Lovable + Supabase architecture that powers thousands of vibe-coded apps. Lovable generates a React frontend that communicates with a Supabase PostgreSQL database via PostgREST.
To enable this communication, it embeds an anonymous API key directly in the JavaScript bundle which is visible to anyone who opens browser DevTools.
This key is not meant to be secret. Supabase documentation explicitly states that the anon key is public and that Row-Level Security (RLS) should protect the data. RLS defines which rows each user can read. The problem is that Supabase defaults to RLS disabled during development, and vibe coders — who have never heard of RLS — ship to production without enabling it.
The result: a single curl command with the publicly available key returns the entire database. Conveniently, no hacking is required.
This exact root cause was behind the Moltbook breach in February 2026, where 1.5 million API tokens and 35,000 email addresses were exposed within three days of launch. The founder had publicly stated “I didn’t write a single line of code.”
It was also behind CVE-2025-48757, a formal CVE for missing RLS in Lovable-generated Supabase projects affecting 170+ production applications.
AI eliminates the easy bugs and introduces the dangerous ones #
Veracode’s 2025 GenAI Code Security Report tested over 100 LLMs across four programming languages and found that 45% of AI-generated code contains security vulnerabilities, which is exactly 2.74 times more frequently than human-written code.
Apiiro’s research on Fortune 50 enterprises showed that while AI coding assistants increased development velocity by 4x, they simultaneously produced 10x more security findings, with privilege escalation paths up 322% and design-level authentication flaws up 153%.
The irony is that AI genuinely reduces surface-level bugs. Syntax errors dropped 76%, and simple logic bugs fell 60%. But it introduces architectural authorization flaws such as code that is syntactically perfect, passes all tests, but asks the wrong question: “is this user logged in?” instead of “is this user allowed to access this specific resource?”
SAST tools cannot catch this because it is not a code error: the code does exactly what it says. The problem is that it says the wrong thing. In one Lovable EdTech incident, the AI generated authentication logic that was inverted: anonymous users received full access while authenticated users were blocked.
In the end, 18,697 user records were exposed, including 4,538 student accounts from UC Berkeley and UC Davis.
Vibe coding optimizes for features, not permissions. Access control is an architectural decision made implicitly by AI, and those implicit decisions are often wrong.
Equixly
Performance, scalability, and the maintainability question #
Security is not the only non-functional requirement that vibe-coded applications fail to meet. AI-generated code frequently includes unnecessary sequential API calls instead of batch operations, lacks caching and database indexing, pulls in entire libraries for single functions, and introduces N+1 query problems. This means that an app that works with 10 test users often falls over with higher user numbers.
Then there is maintainability. AI generates code without explaining why decisions were made. There is no design documentation, architectural decision records or tests. When AI generates a new version, it often rewrites the entire codebase rather than incrementally improving it.
If the original vibe coder leaves the company, the application becomes unmaintainable. This is vendor lock-in 2.0. Rather than a traditional vendor, we’re dependent on a particular AI tool.
The economics (and responsibility) have flipped #
Despite the risks, vibe coding is reshaping software economics in ways that cannot be ignored. KPMG reported in 2025 that generative AI coding is helping enterprises reduce their reliance on large SaaS vendors.
Harvard Business Review argued that the “build vs. buy” equation has fundamentally shifted and building custom solutions with AI is now often cheaper than licensing enterprise software. The trend toward “micro-applications” – small, purpose-built tools replacing million-dollar CRM licenses – is accelerating.
The enterprise features that used to sit behind paywalls – SSO/SAML, RBAC, audit logging, compliance exports – can increasingly be built using open APIs. At Infobip, we have built our own MCP Gateway, an Artifactory security bouncer that replicates enterprise curation features, and AI guardrails infrastructure. All were alternatives to buying vendor software.
But this freedom comes with a condition. Without security, performance, and governance standards, the same democratization that liberates organizations from vendor lock-in creates a new class of risk that traditional security programs were never built to handle.
OWASP now has a Top 10 for agentic applications #
In December 2025, OWASP published its first Top 10 for Agentic Applications, reviewed by NIST, Microsoft’s AI Red Team, Oracle, and the Alan Turing Institute. The list includes Agent Goal Hijack (prompt injection redirecting agent objectives), Tool Misuse and Exploitation (over-privileged tool access), Agentic Supply Chain Vulnerabilities (poisoned MCP servers), and Human-Agent Trust Exploitation (agents manipulating humans into approving harmful actions).
The incidents are already real. EchoLeak demonstrated a zero-click attack where a crafted email silently triggered Microsoft 365 Copilot to exfiltrate confidential data. The Replit Vibe Coding Meltdown saw an agent delete a production database and then generate false outputs to hide the mistake. A malicious MCP server impersonating Postmark on npm secretly BCC’d emails to an attacker.
This new OWASP report does a good job at mapping out agentic threats. A separate report created by Xint, interestingly explains that the most damaging failures are still the oldest ones. Having tested 28 applications, Xint had 8,827 detections, which were collapsed into 513 findings and then 434 verified issues. The most notable examples in the list are very familiar:
-
Secrets exposure (18 verified findings and 11 critical findings)
-
Authorization/IDOR flaws (88 verified findings, 2 critical findings)
-
Resource exhaustion/Dos (93 verified findings, 3 critical findings)
-
Access-boundary weaknesses, such as traversal and SSRF (54 verified findings) In other words, ambient generative IT does not replace classic application security, but rather makes it more urgent and distributed. For us as security experts, it also makes it noticeably harder to ignore.
An effective AI governance framework needs 6 elements #
Gartner’s January 2026 report “How to Secure Enterprise Agentic AI Ambition” defines five workstreams for an Agentic AI Cybersecurity Program:
Multichannel Discovery(find all AI agents, sanctioned and shadow)** Access Modeling**(unique identity and least privilege for every agent)** Scoped Agency**(define scope early, enforce at runtime)** Model Risk Management**(red teaming and guardrails)** Intent-based Monitoring**(behavioral analytics replacing traditional SLAs)
At the policy level, an effective AI governance framework needs six elements:
Mandatory approval before any AI tool is used,A hard data boundary preventing confidential information from entering unapproved systems,Human accountability for all AI-generated output,Identical code review standards for AI and human code,Default-blocked autonomous agents requiring security approvalEthical AI principles ensuring explainability and fairness
At the technical enforcement level, organizations need managed settings that block destructive commands, prevent data exfiltration, restrict access to secret storage locations, control which AI marketplaces and MCP servers are permitted, and maintain full audit telemetry of every tool invocation.
CISOs must prioritize deterministic controls to minimize agentic privilege abuses and contain AI agents’ agency, instead of relying primarily on AI to police itself.
Gartner
Security must be built into every AI tool, agent config, and policy from day one #
There’s no doubt whether Ambient Generative AI will be the norm. The 380,000 exposed applications RedAccess found are not an anomaly, they are the new normal. Organizations are now past the point of deciding on whether they’ll allow AI-assisted development across development, and approaching the point of deciding on the governance, tooling and culture to make it safe.
The same CI/CD pipelines, SAST scanners, code review processes, and identity governance frameworks that protect professionally engineered software must extend to every application, regardless of who (or what) wrote it. Code is code, no matter who authored it.
The ambient future requires ambient security. And that security cannot be an afterthought bolted on after the breach. Security must be woven into the fabric of every AI tool, agent configuration, and organizational policy from day one.