Vibe Coding Security
Vibe coding security is the practice of managing risk in software produced by describing desired behavior to an AI assistant and accepting the generated result with limited review of the underlying code.
The Author Often Cannot Read the Output
Andrej Karpathy named the practice in early 2025, describing a workflow where the developer stops reading diffs and judges the result by whether it runs. The security consequence follows from the review step being absent by design. A product manager shipping an internal tool has no way to notice a hardcoded credential, a missing authorization check or an injection-prone query, since evaluating those requires the reading that the workflow removed.
Working Software Hides the Common Failures
The defects that matter here do not break the demo. Authentication implemented on the client, an API endpoint with no authorization check, secrets committed into the repository and user input concatenated into queries all produce software that works correctly for the person testing it. Failure arrives later, under conditions the author never constructed.
These Applications Skip the Pipeline
Traditional development routes code through review, scanning and deployment controls that catch some of this. Vibe-coded applications frequently deploy straight from an assistant to a hosting platform, with no repository an enterprise scanner can reach and no record in any inventory. The governance problem resembles shadow AI more than it resembles application security, because the first task is finding the applications.
Guardrails Beat Prohibition Here
Banning the practice pushes it to personal accounts, where the applications still handle company data and nobody sees them. Sanctioned platforms with scanning attached, a registration requirement for anything touching customer data, and limits on what credentials these applications can hold address the exposure without removing the speed people are reaching for. AI coding agent security covers the adjacent case where an engineer, rather than a non-engineer, is the one delegating.
Related Terms
Full AI Visibility. Full Control. One Connected Platform.
Enterprise AI is expanding faster than most governance programs can track. Kovrr connects every AI signal across browser, endpoint, network, identity, and vendor systems into a single platform so security, governance, and risk teams work from the same evidence.
