{
  "id": 4877984,
  "title": "Vibe-coded apps are the new shadow IT",
  "url": "https://urgent.news/2026/09/01/vibe-coded-apps-are-the-new-shadow-it",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-01T15:00:00.000Z",
  "source": {
    "name": "The New Stack",
    "slug": "the-new-stack",
    "url": "https://thenewstack.io/vibe-coded-shadow-it/"
  },
  "original_language": "en",
  "account": "Shadow IT is evolving from SaaS tools to AI-generated code, posing a new security risk known as \"code sprawl.\" Unlike traditional shadow IT that can be detected through OAuth logs and network traffic, this new type of shadow IT lives within your cloud infrastructure and has direct access to sensitive systems, making it harder to detect and contain.\n\nEngineers are using AI agents to quickly build internal tools without going through the usual review and security processes. They're unaware of the security risks involved, leading to unintended consequences like public-facing endpoints with overly permissive IAM roles. This poses a significant threat as lateral movement becomes more realistic as the app runs in production for an extended period.\n\nDetecting this new shadow IT requires a different approach than traditional SaaS sprawl. Traditional detection relied on OAuth logs, network traffic, and expense reports. However, this new code sprawl resides within your cloud environment and has direct access to production data, making it harder to find. Your CSPM can help identify misconfigurations, but it only finds what's already deployed, not what's being built.\n\nTo address this new challenge, organizations should implement two layers of defense: platform controls and process controls. Platform controls involve configuring IAM least-privilege guardrails and secrets manager enforcement to make the safe path the easy path. VPN-gated deployment targets and automated baseline checks can further enhance security by ensuring that tooling is deployed behind corporate VPNs and automatically checked against security baselines before deployment.\n\nProcess controls involve human review for all internally built tools that touch production infrastructure. For lower-risk tools, this can be a peer engineer, while for those with cloud infrastructure, direct data access, or novel IAM roles, it escalates to a formal security review. This layered approach ensures that engineers understand the code they're building and that security is a priority, shifting the focus from slowing engineers down to making the safe path the easy one.",
  "summary": "Shadow IT used to be a SaaS problem. Someone on the marketing team signed up for a tool, connected it The post Vibe-coded apps are the new shadow IT appeared first on The New Stack .",
  "key_points": [
    "Vibe-coded apps refer to AI-generated internal tools bypassing security processes.",
    "Implementing platform and process controls is crucial to mitigate the security risks of code sprawl."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}