Vibe-coded apps are the new shadow IT

Shadow IT is evolving from SaaS tools to AI-generated code, posing a new security risk known as "code sprawl." Unlike traditional shadow IT that can be detected through OAuth logs and network traffic, this new type of shadow IT lives within your cloud infrastructure and has direct access to sensitive systems, making it harder to detect and contain.

Engineers are using AI agents to quickly build internal tools without going through the usual review and security processes. They're unaware of the security risks involved, leading to unintended consequences like public-facing endpoints with overly permissive IAM roles. This poses a significant threat as lateral movement becomes more realistic as the app runs in production for an extended period.

Detecting this new shadow IT requires a different approach than traditional SaaS sprawl. Traditional detection relied on OAuth logs, network traffic, and expense reports. However, this new code sprawl resides within your cloud environment and has direct access to production data, making it harder to find. Your CSPM can help identify misconfigurations, but it only finds what's already deployed, not what's being built.

To address this new challenge, organizations should implement two layers of defense: platform controls and process controls. Platform controls involve configuring IAM least-privilege guardrails and secrets manager enforcement to make the safe path the easy path. VPN-gated deployment targets and automated baseline checks can further enhance security by ensuring that tooling is deployed behind corporate VPNs and automatically checked against security baselines before deployment.

Process controls involve human review for all internally built tools that touch production infrastructure. For lower-risk tools, this can be a peer engineer, while for those with cloud infrastructure, direct data access, or novel IAM roles, it escalates to a formal security review. This layered approach ensures that engineers understand the code they're building and that security is a priority, shifting the focus from slowing engineers down to making the safe path the easy one.