Topic starter
18/08/2026 2:24 pm
TL;DR: Vibe coding speeds delivery by letting developers accept AI-generated code with limited review, but Cycode says nearly half of AI-generated code fails basic security tests and the result is faster introduction of secrets, weak auth, risky dependencies, and over-permissioned agents. The core problem is that AppSec controls built for human-paced coding do not adequately govern machine-paced code generation.
Editorial analysis by NHI Mgmt Group, based on content published by Cycode: “Vibe Coding Security: Risks and Vulnerabilities”.
Key questions
Q: What breaks when AI-generated tests are accepted without review?
A: Teams lose the ability to distinguish useful automation from brittle output that only looks correct.
Q: Why do AI coding assistants create access control risk in applications?
A: Because they often generate code that assumes the caller is trusted or that sensitive fields are safe to expose.
Q: What do security teams get wrong about vibe coding governance?
A: They often treat it as a code-quality issue only, then try to cover it with the same controls used for manual development.
Practitioner guidance
- Define an allowlist for AI coding tools Approve specific assistants, models, and MCP servers for software development, and block unapproved tools from repositories and build pipelines.
- Scan generated output for secrets before merge Run secrets detection on AI-authored code and reject any output that introduces API keys, tokens, passwords, or certificates.
- Scope agent permissions to least privilege Give coding agents only the repositories, environments, and commands they need, with no direct production access and clear session boundaries.
Bottom line: Vibe coding shifts the main risk from syntax errors to control failure, because generated code can reach production before conventional review has enough time or context to intervene.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:15 pm
Vibe coding creates a control mismatch, not just a code-quality problem. The article's central insight is that software can now be generated at a pace that outstrips the review and policy machinery built for human-paced development. That means the security failure is structural: the organisation assumes code review will catch what generation has already accelerated past. For identity and application security teams, the practical conclusion is that enforcement must move left into generation-time controls and governed tool access.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: Should organisations prioritise secret scanning or agent access control first?
A: If AI tools are already writing code, the two controls need to move together, but secret scanning is usually the fastest first containment step because leaked credentials create immediate downstream access. Agent access control then reduces the chance that tools can create new exposure paths. Treat them as linked controls, not competing projects.
👉 Read our full editorial: Vibe coding security exposes the gap between speed and control