Topic starter
18/08/2026 2:40 pm
TL;DR: AI coding assistants are accelerating code production faster than security controls are adapting, with Kusari reporting 85% adoption but only 9% treating AI-driven AppSec analysis as a must-have. That gap is allowing hallucinated dependencies, insecure patterns, and outdated libraries to reach production, turning AI-generated code into a measurable AppSec governance problem.
Editorial analysis by NHI Mgmt Group, based on content published by Kusari: “Vibe Coding & Vulnerabilities: A Security Team's Guide to AI-Generated Code Risks”.
Key questions
Q: What should teams do first before relying on AI to write production code?
A: Start with low-risk use cases such as boilerplate generation, test scaffolding, and documentation drafts.
Q: Why do AI coding agents increase supply-chain risk?
A: AI coding agents can choose tooling, install packages, and edit lock files in ways that may bypass the controls humans expect in a managed environment.
Q: What are the signs that vibe coding controls are failing?
A: Common warning signs include new dependencies appearing without review, repeated insecure patterns in generated code, and AI-authored changes reaching merge without security feedback.
Practitioner guidance
- Enforce pull request gates for AI-generated code Run SAST and SCA on every pull request and block merges when generated code introduces critical vulnerabilities or unapproved dependencies.
- Block unvetted package installation Require approval for new dependencies and flag phantom packages or unusual package name patterns before they can enter the build.
- Tag and track AI-authored changes Use commit metadata, IDE signals, or repository conventions to identify code that came from AI assistants so reviewers know where extra scrutiny is needed.
Bottom line: Vibe coding turns AI-generated code into a governance problem because insecure logic, missing checks, and bad dependencies can enter the pipeline before human review catches them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:24 pm
Vibe coding security vulnerabilities create a provenance problem, not just a code-quality problem. The issue is not limited to bad syntax or weak coding style. When the author of record becomes an AI assistant, security teams lose the normal human accountability that review processes assume, and that changes how code must be governed. Practitioners should treat generated code as a distinct trust class with its own controls.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should engineering teams treat AI-generated code differently from human-written code?
A: Yes. AI-generated code should pass the same security and quality standards, but it often needs stricter provenance, deeper review on sensitive paths, and stronger automated controls because volume and ambiguity increase the chance of missed defects. The right response is not special treatment, but stronger governance where risk is highest.
👉 Read our full editorial: Vibe coding security vulnerabilities are creating a new AppSec blind spot