Warning to enterprises: Vibe coding can be a threat
Vibe coding is a top security threat to enterprises and could leak data into the public sphere, analysts and executives are saying. “The number one risk at the minute is hard-coded secrets being uploaded through vibe-coded applications to GitHub, and then providing a route in,” said Pete Shoard, chief of research for cybersecurity at Gartner. The term “vibe coding” was coined by Andrej Karpathy…
The term "vibe coding" has emerged as a new security threat to enterprises, potentially leaking sensitive data into the public sphere, according to analysts and executives. Pete Shoard, chief of research for cybersecurity at Gartner, emphasized that the primary risk is the upload of hard-coded secrets through vibe-coded applications to GitHub.
Andrej Karpathy coined the term "vibe coding" to describe how developers can now create applications using generative AI (genAI) tools and services. This rapid adoption has caught enterprises off guard, leading them to encourage non-tech employees to engage in vibe coding for faster application development and prototype creation.
However, this new approach to coding comes with significant risks. Erik Nost, a senior security analyst at Forrester Research, warned that vibe coding expands the enterprise attack surface due to its accessibility to teams without technical expertise. The Massey University and University of Auckland study found that 62% of the motivation for vibe coding is speed and efficiency, as AI coding tools produce working software in hours rather than weeks.
But this speed often comes at the cost of security checks, with AI tools potentially hallucinating and overlooking subtle logic errors, performance bottlenecks, or serious security flaws. Gartner's Shoard cautioned that not all of the hundreds of applications created through vibe coding will be scanned or vetted, leaving opportunities for sensitive information or intellectual property to leak.
The current hype around vibe coding has even caused some to question its feasibility compared to traditional enterprise software development. Frank Erickson of 28Stone, a consulting firm, highlighted the difference between vibe coding and enterprise software development, stressing that vibe coding cannot scale or outright replace the former.
To mitigate these risks, researchers recommend implementing heavy auditing, skilled prompts, and continuous technical debt monitoring as part of a responsible framework for adopting AI-assisted programming.
Written by urgent.news from Computerworld's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
