{"slug": "warning-to-enterprises-vibe-coding-can-be-a-threat", "title": "Warning to enterprises: Vibe coding can be a threat", "summary": "Vibe coding, the practice of creating applications through generative AI chat tools, is emerging as a top security threat to enterprises, with hard-coded secrets uploaded to GitHub posing the number one risk, according to Pete Shoard, chief of research for cybersecurity at Gartner. A study by Massey University and the University of Auckland found that 62% of vibe coders are motivated by speed and efficiency, but analysts warn that the rapid development often skips security checks, expanding the enterprise attack surface and risking data leaks.", "body_md": "Vibe coding is a top security threat to enterprises and could leak data into the public sphere, analysts and executives are saying.\n\n“The number one risk at the minute is hard-coded secrets being uploaded through vibe-coded applications to GitHub, and then providing a route in,” said Pete Shoard, chief of research for cybersecurity at Gartner.\n\nThe term “vibe coding” was [coined by Andrej Karpathy](https://x.com/karpathy/status/1886192184808149383?lang=en) as a way to describe how developers can now create applications by chatting with generative AI (genAI) tools and services. AI can quickly generate code to create a program, a dramatic change from the typical manual development process.\n\nNot surprisingly, vibe coding [became the latest rage in the developer community](https://www.computerworld.com/article/4024172/i-vibe-coded-a-dog-birthday-app-we-still-need-developers.html) almost immediately.\n\nEnterprises have been [rushing to upskill employees](https://www.computerworld.com/article/4117602/what-ai-skills-job-seekers-need-to-develop-in-2026.html) to take advantage of the technology by encouraging non-tech employees to vibe-code applications. Companies have seen the benefits, including faster application development and quick creation of prototypes or mockups of final products.\n\n“Vibe coding makes writing apps more accessible to teams that don’t have developer or security experience, which expands the enterprise attack surface,” said Erik Nost, senior security analyst at Forrester Research.\n\nSoftware companies aren’t necessarily “vibe coding” software patches, but they are able to leverage AI tools to help accelerate writing them, Nost said.\n\n“The most common motivation theme for vibe coding — 62% — is speed & efficiency, with vibe coders highlighting rapid development,” researchers from Massey University and the University of Auckland wrote in a [research study published last month](https://dl.acm.org/doi/epdf/10.1145/3786583.3786866).\n\nAI coding tools produce working software in hours instead of weeks. But the rapidly advancing coding processes [often neglect code reviews or security checks](https://www.computerworld.com/article/4120099/jamf-has-a-warning-for-macos-vibe-coders.html), raising the risk of undetected vulnerabilities.\n\n“Others emphasized that while the outputs might appear clean and functional, they could conceal subtle logic errors, performance bottlenecks, or serious security flaws that only become apparent later,” the researchers wrote.\n\nAI tools can [hallucinate](https://www.computerworld.com/article/4067372/how-to-curb-hallucinations-in-copilot-and-other-genai-tools.html) with poor prompting, and the same can happen with vibe coding. That’s why significant audit tools are required to verify and validate the results, said academic researchers from the US and UK in a June 30 paper [published by the Association for Computing Machinery](https://dl.acm.org/doi/10.1145/3797105).\n\nEmployees who turn to vibe coding can quickly spin up hundreds of applications, but those efforts can also create problems, according to Gartner’s Shoard. “Not all of them will be scanned,” he said. “There will be no commonality. It’s not a patch that everyone can install.”\n\nThe big danger is that sensitive information or intellectual property can leak, Shoard said.\n\nFor example, vibe-coding tools could in many cases sync data files with public repositories like GitHub, unintentionally uploading internal corporate files to the internet.\n\nThe current vibe-coding hype has “done AI a massive disservice,” said Frank Erickson of 28Stone, a consulting firm that develops software for the capital markets. “There’s a huge difference between vibe coding and enterprise software development, and some of the loudest, most aggressive proponents of AI are a bit too latched onto the concept,” he said.\n\nAI might be changing the nature of a variety of jobs, especially for developers, but vibe coding can’t scale — and it can’t outright replace enterprise software development. “I get pretty perturbed when our people internally refer to AI tooling as vibe coding. If they think that’s what they’re doing, they’re misunderstood,” Erickson said.\n\nVibe coding, while potentially good for software prototyping, should be governed by guidelines and development principles, researchers said. That would include heavy auditing to address hallucinations and security risks, as well as skilled prompts to provide better context, the US and UK researchers wrote.\n\n“AI functions primarily as an assistant…, providing localized code suggestions and learning support while leaving overall direction, integration, and validation to the human developer,” they said.\n\nBeyond automated security auditing, [governance](https://www.computerworld.com/article/4173442/enterpriseclaw-wants-to-bring-governance-to-the-openclaw-era-2.html) should include “continuous technical debt monitoring,” Indonesian researchers said in a [research paper published last month](https://www.researchgate.net/publication/410965816_A_Systematic_Analysis_of_AI-Assisted_Vibe_Coding_in_Software_Development_Opportunities_Challenges_and_Risks).\n\nThe researchers proposed a vibe-coding framework that includes inspecting, interpreting, and validating AI-generated code as part of the typical software development lifecycle. This foundation “provides for developing risk-based governance policies that can guide … in adopting AI-assisted programming responsibly,” the researchers wrote.", "url": "https://wpnews.pro/news/warning-to-enterprises-vibe-coding-can-be-a-threat", "canonical_source": "https://www.computerworld.com/article/4210633/warning-to-enterprises-vibe-coding-can-be-a-threat.html", "published_at": "2026-08-18 11:00:00+00:00", "updated_at": "2026-08-18 11:10:48.123870+00:00", "lang": "en", "topics": ["generative-ai", "ai-tools", "ai-safety", "ai-policy"], "entities": ["Gartner", "Pete Shoard", "Andrej Karpathy", "Forrester Research", "Erik Nost", "Massey University", "University of Auckland", "28Stone"], "alternates": {"html": "https://wpnews.pro/news/warning-to-enterprises-vibe-coding-can-be-a-threat", "markdown": "https://wpnews.pro/news/warning-to-enterprises-vibe-coding-can-be-a-threat.md", "text": "https://wpnews.pro/news/warning-to-enterprises-vibe-coding-can-be-a-threat.txt", "jsonld": "https://wpnews.pro/news/warning-to-enterprises-vibe-coding-can-be-a-threat.jsonld"}}