Vibe coding is becoming an enterprise security risk

Vibe coding expands the enterprise attack surface

Speed is the main attraction of vibe coding. Researchers from Massey University and the University of Auckland found that 62% of vibe coders cited speed and efficiency as their main motivation. Generative AI can produce working applications in hours rather than weeks. It also allows employees with limited software development experience to build applications through natural-language prompts.

That changes who can create software inside a company. Business teams can develop prototypes, internal tools, and applications without waiting for a conventional development cycle. This can shorten the path from an idea to a working product and help companies test ideas at lower cost.

It also creates a security problem. Erik Nost, senior security analyst at Forrester Research, said vibe coding makes application development accessible to teams without developer or security experience. As more employees create software, the enterprise attack surface grows. Each application can introduce vulnerable code, unsafe data access, weak authentication, or poorly configured external services.

The core constraint is governance capacity. AI can increase software output much faster than a security team can increase its review capacity. A company can therefore produce applications faster than it can inventory, test, approve, and maintain them. Traditional controls built around professional development teams may struggle when software creation becomes decentralized.

Executives should treat this as a software governance issue. AI-assisted development can increase productivity, but every application that reaches corporate data or production systems needs clear ownership and minimum security controls. Companies need visibility into what employees build, where the code resides, what data it can access, and who is responsible for maintaining it. This preserves the speed advantage while putting boundaries around the additional risk.

Hard-coded secrets and data leakage create an immediate security risk

The most urgent risk is concrete: sensitive credentials can end up in publicly accessible code. Pete Shoard, chief of research for cybersecurity at Gartner, identified hard-coded secrets uploaded through vibe-coded applications to GitHub as the current “number one risk.”

A hard-coded secret is a credential stored directly inside source code or a configuration file. It can include an API key, access token, password, or cloud credential. If an employee pushes that code to a public GitHub repository, the credential can become accessible outside the company. An attacker who obtains a valid secret may be able to access the systems and data associated with it.

The exposure can extend beyond credentials. Vibe-coding tools may synchronize local files with public repositories. An employee can therefore publish internal data, proprietary code, configuration files, or other intellectual property without intending to make it public. The application itself may work correctly while the development process creates the security incident.

This risk matters because AI substantially lowers the effort required to create software. Employees can generate many applications quickly, while security review remains a slower process. Shoard warned that employees can create hundreds of applications and that “not all of them will be scanned.” The applications may also lack common design and maintenance patterns, which makes centralized remediation harder.

Executives need controls at the points where code, credentials, and data leave the enterprise. Secret scanning, repository access policies, automated security checks, data-loss controls, and managed AI development environments can reduce exposure. Companies also need an inventory of AI-generated applications and accountable owners for each one.

The goal is to keep fast experimentation viable within defined limits. Applications that handle corporate data, credentials, or production access require stronger controls than disposable prototypes. Clear boundaries allow employees to gain the productivity benefits of vibe coding without turning rapid software creation into uncontrolled data exposure.

Faster code generation can outrun security review

Vibe coding can reduce application development from weeks to hours. That speed creates business value through faster prototypes, shorter development cycles, and quicker testing of new ideas. It also creates a clear operational constraint: companies can generate code faster than they can review it.

Security and quality controls still require time. Code needs to be inspected for vulnerabilities, logic errors, unsafe dependencies, access-control problems, and performance issues. When employees generate applications rapidly, these checks can be skipped or delayed. A working interface provides little evidence about the quality or security of the underlying code.

Researchers from Massey University and the University of Auckland highlighted this problem. Their research found that speed and efficiency accounted for 62% of the motivation for vibe coding. They also warned that apparently clean and functional AI-generated software can contain subtle logic errors, performance bottlenecks, and serious security flaws that become visible later.

The same productivity gains can apply to professional software engineering. Erik Nost, senior security analyst at Forrester Research, said software companies can use AI tools to accelerate writing software patches. This shows the broader value of AI-assisted development: skilled teams can use these systems to shorten parts of an established engineering process while retaining their existing controls.

For executives, review capacity is the key constraint. Increasing the number of applications without increasing automated testing, security scanning, and technical oversight creates a growing backlog of unverified code. That gap becomes more serious when applications connect to customer data, internal systems, payment services, or production infrastructure.

Companies should therefore make security checks part of the development path itself. Automated code scanning, dependency checks, secret detection, testing, and approval rules can operate before deployment. Higher-risk applications should receive deeper human review. This approach lets the company capture development speed while maintaining a defined standard for production software.

AI-generated code requires systematic validation

Generative AI can produce code that looks plausible and runs successfully while still containing errors. This behavior is commonly described as hallucination: the model generates an output that appears credible but is incorrect, incomplete, or unsuitable for the intended context. Poor or incomplete prompts can increase this risk.

For software, the consequences can extend beyond an incorrect answer on a screen. Generated code can introduce faulty business logic, insecure configurations, weak error handling, or vulnerabilities. Some defects may remain hidden during basic functional testing and emerge only under specific conditions or production workloads.

US and UK academic researchers addressed this issue in a June 30 paper published by the Association for Computing Machinery (ACM). They called for substantial auditing to verify and validate AI-generated results. They also emphasized the importance of skilled prompting, which gives the model stronger context about requirements, constraints, and the environment in which the code will operate.

The researchers define a practical role for these systems: “AI functions primarily as an assistant…, providing localized code suggestions and learning support while leaving overall direction, integration, and validation to the human developer.” This division of responsibility matters for enterprise use. AI can accelerate individual coding tasks, while qualified developers retain accountability for architecture, system integration, security, and final validation.

Executives should treat validation capacity as a prerequisite for scaling AI-assisted development. Automated tools can scan generated code continuously and identify many common vulnerabilities or quality problems. Human expertise remains important for assessing business logic, architecture, unusual security conditions, and whether the software actually meets its requirements.

Better prompts can improve output quality, but prompting is one part of the control system. The stronger operating model combines clear requirements, skilled AI use, automated testing, security auditing, and human approval based on application risk. This gives enterprises a practical route to increase AI-assisted development while keeping responsibility for production software clearly defined.

Application volume can overwhelm enterprise security controls

Vibe coding changes the scale of internal software creation. Employees can generate many applications in a short period, including prototypes, workflow tools, and applications that connect to corporate systems. Pete Shoard, chief of research for cybersecurity at Gartner, warned that employees can quickly create hundreds of applications and that “not all of them will be scanned.”

The main constraint is security capacity. Development with generative AI can scale rapidly because much of the code generation is automated. Security teams still need to identify applications, assess their permissions, scan their code, track dependencies, investigate vulnerabilities, and manage remediation. Application creation can therefore grow faster than the organization’s ability to govern it.

Fragmentation makes this problem harder. Vibe-coded applications may use different architectures, libraries, AI services, repositories, and deployment methods. Shoard said, “There will be no commonality. It’s not a patch that everyone can install.” A vulnerability can therefore require different remediation work across many independently created applications.

Visibility becomes a basic requirement. An enterprise cannot secure applications it does not know exist. Companies need an inventory that records each AI-generated application, its owner, source-code location, deployment environment, dependencies, permissions, and access to sensitive data. Discovery should be automated where practical because manual reporting becomes unreliable as application numbers increase.

Executives should also control how applications move from experimentation into business use. Low-risk prototypes can operate within restricted environments. Applications that access sensitive information, customer records, credentials, or production systems require stronger testing and approval. This risk-based approach concentrates security resources where failure would have the greatest business impact.

The objective is to make security controls scale with software creation. Automated application discovery, code scanning, secret detection, dependency monitoring, and deployment policies can handle much of the increased volume. Clear ownership remains essential. Every application that becomes part of a business process needs someone accountable for its security, maintenance, and eventual retirement.

Vibe coding works well for prototyping, while enterprise software requires deeper engineering

Vibe coding has a strong use case in rapid experimentation. Employees can turn requirements into working prototypes quickly, test user experiences, build mockups, and evaluate ideas before committing significant engineering resources. This can reduce the time and cost required to determine whether an application concept deserves further investment.

Enterprise software carries a broader set of requirements. Production systems must remain secure, maintainable, integrated, observable, and reliable over time. Developers also need to understand how the generated code interacts with existing applications, data, infrastructure, authentication systems, and regulatory controls. Fast code generation addresses only part of that work.

Frank Erickson of 28Stone, a consulting firm that develops software for capital markets, argues that the distinction matters. “There’s a huge difference between vibe coding and enterprise software development, and some of the loudest, most aggressive proponents of AI are a bit too latched onto the concept,” he said. Erickson also said the current enthusiasm around vibe coding has “done AI a massive disservice.”

Erickson applies the same distinction inside his own organization. “I get pretty perturbed when our people internally refer to AI tooling as vibe coding. If they think that’s what they’re doing, they’re misunderstood,” he said. His point separates casual prompt-driven application creation from professional engineers using AI within a structured development process.

For executives, that distinction affects investment decisions and accountability. AI coding tools can increase developer productivity and accelerate specific engineering tasks. Skilled teams still need to make architectural decisions, integrate systems, validate security, manage dependencies, test software, and maintain it throughout its operational life.

The practical approach is to define different standards by use case. A temporary prototype can operate with limited access and a short lifecycle. Software that enters production needs established engineering, security, testing, and ownership requirements regardless of how much code AI generated.

This preserves the strongest benefit of vibe coding: rapid exploration. It also gives professional development teams room to use AI as an engineering tool within controlled processes. For C-suite leaders, the strategic opportunity comes from applying each model where its speed, risk, and lifecycle characteristics fit the business requirement.

AI-assisted development needs risk-based governance

Enterprises need governance that treats AI-generated code as part of the standard software development lifecycle. The central requirement is accountability. Every application needs an owner, a defined risk level, security controls, validation, and a process for maintenance. AI can accelerate code generation, while the organization remains responsible for every system it deploys.

US and UK academic researchers made human responsibility central to their recommendations in a June 30 paper published by the Association for Computing Machinery (ACM). They wrote that “AI functions primarily as an assistant…, providing localized code suggestions and learning support while leaving overall direction, integration, and validation to the human developer.”

That division of responsibility gives enterprises a practical operating model. AI can generate code, suggest changes, and support developers. Humans remain responsible for architecture, integration, business logic, security decisions, and final approval. This becomes especially important when software handles customer information, intellectual property, credentials, financial transactions, or critical business processes.

Governance also needs to cover the full software lifecycle. Indonesian researchers proposed a framework that incorporates inspecting, interpreting, and validating AI-generated code into established development processes. They also called for “continuous technical debt monitoring.” Technical debt refers to design or implementation choices that create additional maintenance work or risk over time. Generative AI can increase this burden when teams accept generated code without understanding its structure, dependencies, or long-term maintenance requirements.

Risk should determine the strength of the controls. A limited prototype working with synthetic data requires a different level of oversight from an application connected to production databases or customer records. Higher-risk systems need stronger access controls, automated security scanning, testing, human review, and formal deployment approval. Lower-risk experimentation can use lighter processes within controlled environments.

Executives should also ensure governance operates through technical controls. Written policies alone cannot keep pace when employees can create applications in hours. Approved AI tools, managed code repositories, automated secret detection, vulnerability scanning, dependency checks, access restrictions, and deployment controls can enforce requirements as software is created.

The Indonesian researchers said their framework provides a foundation for developing risk-based governance policies for responsible adoption of AI-assisted programming. This is the key management task. Companies can give employees and developers access to faster development tools while setting clear boundaries around data, production access, security, and accountability.

The strategic goal is controlled scale. AI can increase the amount of software an organization produces and shorten development cycles. Governance must scale at the same time. Companies that automate routine controls, assign clear ownership, and apply deeper review to higher-risk systems are better positioned to capture AI’s productivity gains while keeping enterprise software secure and maintainable.

In conclusion

Vibe coding has a clear business value. It can reduce development time from weeks to hours, widen access to software creation, and make experimentation cheaper. The limiting factor is now the enterprise’s ability to govern what gets built.

Executives should set the operating model before application volume accelerates. Every production application needs an accountable owner, controlled access to data and credentials, automated security checks, and validation appropriate to its risk. Higher-risk systems require deeper engineering and human review.

The strategic decision is therefore about control and scale. Companies that pair AI-assisted development with automated governance can move faster without allowing application sprawl, leaked secrets, and hidden vulnerabilities to accumulate. AI can increase software output dramatically. Security, ownership, and governance must scale with it.