Notifications
Clear all
Topic starter
18/08/2026 2:24 pm
TL;DR: Vibe coding speeds delivery by letting developers accept AI-generated code with limited review, but Cycode says nearly half of AI-generated code fails basic security tests and the result is faster introduction of secrets, weak auth, risky dependencies, and over-permissioned agents. The core problem is that AppSec controls built for human-paced coding do not adequately govern machine-paced code generation.
NHIMG editorial — based on content published by Cycode: Vibe Coding Security: Risks and Vulnerabilities
By the numbers:
- Stack Overflow’s 2025 survey found that 84% of developers use or plan to use AI tools.
- Repositories with an AI assistant enabled were 40% more likely to leak API keys, passwords, or tokens.
Questions worth separating out
Q: What breaks when vibe coding is used without security controls?
A: The main failure is that insecure code, secrets, weak authentication, and risky dependencies move into production faster than teams can review them.
Q: Why do access sprawl and AI workflows create more identity risk?
A: Because they multiply the number of places where credentials, approvals, and delegated actions can occur without clear ownership.
Q: What do security teams get wrong about secrets in generated code?
A: They often assume secret scanning alone is enough.
Practitioner guidance
- Inventory every AI coding tool and agent Build an allowlist of assistants, MCP servers, and agentic tools that can touch source code, build systems, or cloud resources.
- Classify generated secrets as lifecycle-managed credentials Scan IDE output, pull requests, and CI artifacts for hardcoded API keys, tokens, and certificates, then route any found secret into your standard rotation and revocation process.
- Scope agent permissions to least privilege Remove direct production access from coding agents, separate developer credentials from agent credentials, and restrict write access to only the repositories and environments the workflow truly needs.
What's in the full article
Cycode's full blog covers the operational detail this post intentionally leaves for the source:
- A practical checklist for securing vibe-coded applications across IDE, CI, and deployment workflows
- Comparative notes on AI code security tools and where they fit in the software delivery lifecycle
- Vendor-side guidance on detecting secrets, dependency issues, and AI-generated vulnerabilities before release
- Implementation examples for governance, guardrails, and code-to-runtime context in AppSec programmes
👉 Read Cycode's full analysis of vibe coding security risks and vulnerabilities →
Vibe coding security risks and governance gaps: are controls keeping up?
Explore further
18/08/2026 3:15 pm
Vibe coding security is now an identity governance problem as much as an application security problem. The article makes clear that generated code often carries secrets, credentials, and access assumptions into production. That means the security boundary is no longer just the repository, but the identities and permissions of the AI tools that touch it. Teams should govern AI coding workflows with the same discipline they apply to NHI estates and privileged human access.
A question worth separating out:
Q: How should organisations govern AI agents that can modify repository code?
A: They should treat the agent as a delegated non-human identity with tightly bounded authority. Separate instruction input from execution rights, require human approval for write actions, and log every agent-initiated change with enough context to support review. If the agent can edit code without that separation, prompt injection becomes a privilege escalation path.
👉 Read our full editorial: Vibe coding security exposes the gap between speed and control
