Vibe coding is a top security threat to enterprises and could leak data into the public sphere, analysts and executives are saying.
“The number one risk at the minute is hard-coded secrets being uploaded through vibe-coded applications to GitHub, and then providing a route in,” said Pete Shoard, chief of research for cybersecurity at Gartner.
The term “vibe coding” was coined by Andrej Karpathy as a way to describe how developers can now create applications by chatting with generative AI (genAI) tools and services. AI can quickly generate code to create a program, a dramatic change from the typical manual development process.
Not surprisingly, vibe coding became the latest rage in the developer community almost immediately.
Enterprises have been rushing to upskill employees to take advantage of the technology by encouraging non-tech employees to vibe-code applications. Companies have seen the benefits, including faster application development and quick creation of prototypes or mockups of final products.
“Vibe coding makes writing apps more accessible to teams that don’t have developer or security experience, which expands the enterprise attack surface,” said Erik Nost, senior security analyst at Forrester Research.
Software companies aren’t necessarily “vibe coding” software patches, but they are able to leverage AI tools to help accelerate writing them, Nost said.
“The most common motivation theme for vibe coding — 62% — is speed & efficiency, with vibe coders highlighting rapid development,” researchers from Massey University and the University of Auckland wrote in a research study published last month.
AI coding tools produce working software in hours instead of weeks. But the rapidly advancing coding processes often neglect code reviews or security checks, raising the risk of undetected vulnerabilities.
“Others emphasized that while the outputs might appear clean and functional, they could conceal subtle logic errors, performance bottlenecks, or serious security flaws that only become apparent later,” the researchers wrote.
AI tools can hallucinate with poor prompting, and the same can happen with vibe coding. That’s why significant audit tools are required to verify and validate the results, said academic researchers from the US and UK in a June 30 paper published by the Association for Computing Machinery.
Employees who turn to vibe coding can quickly spin up hundreds of applications, but those efforts can also create problems, according to Gartner’s Shoard. “Not all of them will be scanned,” he said. “There will be no commonality. It’s not a patch that everyone can install.”
The big danger is that sensitive information or intellectual property can leak, Shoard said.
For example, vibe-coding tools could in many cases sync data files with public repositories like GitHub, unintentionally up internal corporate files to the internet. The current vibe-coding hype has “done AI a massive disservice,” said Frank Erickson of 28Stone, a consulting firm that develops software for the capital markets. “There’s a huge difference between vibe coding and enterprise software development, and some of the loudest, most aggressive proponents of AI are a bit too latched onto the concept,” he said.
AI might be changing the nature of a variety of jobs, especially for developers, but vibe coding can’t scale — and it can’t outright replace enterprise software development. “I get pretty perturbed when our people internally refer to AI tooling as vibe coding. If they think that’s what they’re doing, they’re misunderstood,” Erickson said.
Vibe coding, while potentially good for software prototyping, should be governed by guidelines and development principles, researchers said. That would include heavy auditing to address hallucinations and security risks, as well as skilled prompts to provide better context, the US and UK researchers wrote.
“AI functions primarily as an assistant…, providing localized code suggestions and learning support while leaving overall direction, integration, and validation to the human developer,” they said.
Beyond automated security auditing, governance should include “continuous technical debt monitoring,” Indonesian researchers said in a research paper published last month.
The researchers proposed a vibe-coding framework that includes inspecting, interpreting, and validating AI-generated code as part of the typical software development lifecycle. This foundation “provides for developing risk-based governance policies that can guide … in adopting AI-assisted programming responsibly,” the researchers wrote.