The promise of vibe coding is genuinely seductive. Describe a feature in plain English, and an AI agent writes the code. What used to take a developer days to scaffold now takes hours.

Over a third of enterprise development teams were already using AI to generate large code blocks from natural language prompts by early 2026, according to JetBrains.

The productivity gains are real — but so is the risk exposure quietly accumulating behind the speed.

For IT leaders, CISOs, and engineering executives, vibe coding is no longer a curiosity confined to side projects and hackathons. It is landing in production environments, touching regulated data, and connecting to core enterprise systems — often without a security review, a governance policy, or even a human who fully understands what was built. This post breaks down what vibe coding actually is, why it introduces a fundamentally different class of risk, and what enterprise leaders can do about it right now.

What Is Vibe Coding — and Why Is It Different?

Vibe coding is building software by describing what you want in plain language and letting an AI generate the code. You prompt, the AI writes, and the developer's role moves from author to director.

More precisely, vibe coding describes the practice of generating complete, working code from natural language prompts with minimal review before committing. The developer describes a feature, the AI generates a full implementation, and the developer accepts it after confirming it runs — not after reviewing it for correctness, security, or edge-case handling.

This is meaningfully different from a senior engineer using GitHub Copilot to autocomplete a function.

Vibe coding, in a nutshell, is the notion of building products with nothing but AI tools and natural language prompts, and it should be understood as distinct from agentic coding or agentic engineering, which entail more deliberate use of AI coding tools by an experienced programmer.

What used to be an Excel file with macros is today a complete web application — built in two hours by a business unit without any software engineering experience. Vibe coding is fundamentally changing the IT landscape in companies.

That democratisation of development is exactly what makes it a governance challenge. When anyone can build anything, the attack surface expands dramatically.

The Vulnerability Problem Is Bigger Than You Think

The instinct to focus on the productivity upside of AI-generated code is understandable. The security data, however, is sobering.

Veracode's 2025 GenAI Code Security Report tested more than 100 large language models and found that 45% of AI-generated code exhibited security vulnerabilities associated with the OWASP Top 10.

Another 2025 study by the Cloud Security Alliance reported security flaws in 62% of AI-generated code solutions.

What makes this especially alarming is that the problem does not self-correct through iteration.

A 2025 IEEE-ISTAS controlled experiment measured a 37.6% increase in critical vulnerabilities after just five rounds of AI-assisted code refinement. Iterating on AI output does not self-correct security flaws — it compounds them.

When AI coding agents are prompted to produce cloud infrastructure templates, they consistently generate over-permissive IAM configurations — effectively granting access across all resources. Apiiro's analysis of AI-generated code in Fortune 50 enterprises found 322% more privilege escalation paths and 153% more design flaws compared to human-written code.

Real-world incidents have already proven the consequences.

The Tea app became one of the most-discussed vibe coding incidents of 2025, exposing private user direct messages to other users due to broken access control logic that the AI generated without any security review.

Shadow IT 2.0: The Governance Gap No Policy Has Caught Up To

The governance challenge with vibe coding is not simply a more intense version of shadow IT — it is structurally different.

The challenge of shadow IT has occupied enterprise security programs for more than a decade, but vibe coding does not simply extend that problem; it changes its character in ways that existing playbooks are poorly positioned to address.

Shadow AI use is rising rapidly across organisations. The 2026 Verizon Data Breach Investigations Report logged 858,440 shadow AI events in a single year, making it the third most common insider action.

The governance void is equally stark.

While 91% of enterprises lack an AI governance framework according to McKinsey, CVEs formally attributed to AI-generated code rose from 6 in January 2026 to 35 in March 2026.

Only 38% of organisations had a formal AI governance policy as of May 2026 — and 63% of organisations that experienced AI-related breaches lacked a governance policy.

Vibe coding creates operational risks when unreviewed software connects to sensitive enterprise data, core APIs, and production systems.

Vibe coding tools like Claude Code, Cursor, and Replit were built to make rapid building possible. However, they were not built to make it governable — and that gap is where enterprise risk is quietly accumulating.

The Slopsquatting Threat: A Supply Chain Attack Born from AI Hallucination

One of the least-discussed but most consequential risks of vibe coding is what happens when an AI recommends a software package that does not exist.

A new class of software supply chain attack — coined "slopsquatting" — exploits the documented tendency of large language models to produce fabricated package names. When developers install these hallucinated packages, or when AI coding agents resolve them autonomously, they may receive attacker-controlled payloads instead.

The scale of this problem is significant.

A USENIX Security 2025 study of 2.23 million code samples found that 19.7% referenced at least one hallucinated package, and 43% of those invented names reappeared on every rerun.

Because 58% of hallucinated package names reappeared at least once within ten runs of the same query, this reproducibility means attackers can map predictable hallucinations in advance.

The threat has moved from theoretical to confirmed: real-world malicious packages exploiting this vector have accumulated tens of thousands of downloads. Organisations should treat slopsquatting as an active supply chain risk requiring immediate action.

AI-assisted commits also expose secrets at 3.2%, compared with 1.5% for public human commits — more than double the rate, according to GitGuardian's State of Secrets Sprawl report.

This credential sprawl is compounding the supply chain problem with an identity and access management crisis.

Compliance Exposure: Regulators Are Already Watching

For enterprise leaders in regulated industries, vibe coding carries a compliance dimension that cannot be deferred.

If a vibe-coded application handles sensitive data without adequate encryption or access controls, the organisation risks severe compliance violations under regulatory frameworks.

Organisations in regulated industries should map their AI coding governance framework to relevant control frameworks — PCI DSS, SOC 2, ISO 27001 — now, before auditors begin explicitly asking about AI coding governance.

The regulatory clock is ticking.

The EU AI Act's general provisions apply from August 2, 2026, requiring enterprises with high-risk AI systems to implement data governance controls, including automated data lineage tracking and audit trail documentation.

Under Article 99 of the EU AI Act, violations involving prohibited AI practices can carry penalties of up to €35 million or 7% of global annual turnover.

AI governance is no longer a voluntary best practice — it's rapidly becoming a legal and regulatory requirement across industries and jurisdictions.

Practical Tips for IT Leaders: Building a Vibe Coding Governance Framework

The answer is not a blanket ban.

The right answer is neither a ban nor uncontrolled permissiveness.

Organisations that treat vibe coding as a developer toy rather than an enterprise capability will repeat the shadow IT cycle: uncontrolled adoption, followed by a security incident, followed by a blanket ban that pushes innovation underground — and that cycle is expensive and preventable.

Here is what effective enterprise governance of vibe coding looks like in practice:

A centralised registry of all vibe-coded tools — who built them, what data they access, and when they were last updated — is the minimum viable governance layer. Without it, you are governing in the dark.

High-risk use cases requiring standard engineering review include applications handling confidential customer or financial data, tools that write to core production databases or ERP platforms, and systems managing authentication, single sign-on, or access controls.

Any AI coding tool with access to production credentials or infrastructure APIs should be treated as a privileged system. Actively scan repositories for secrets and credentials introduced through AI-assisted commits.

Lockfile pinning and package hash verification should be enforced across all CI/CD pipelines, and AI agents with package management capabilities must be prohibited from installing packages without human review or an allowlist gate.

Treat every AI-generated project as a governance artefact from day one — assigning an owner, documenting what data the project touches and which models it calls, and capturing that information at the moment of creation.

AI agents should have least-privilege access, just like human developers. Critical actions must require human approval, and you need observability tooling to trace why a code change was made.

NIST and OWASP published AI coding governance guidance in 2025 and 2026 respectively. Most enterprise security teams use these as starting frameworks and adapt them to their specific stack and compliance requirements.

Conclusion: Governance Is the Real Competitive Advantage

Vibe coding is not going away. The productivity case is too strong, adoption is too deep, and the tooling is improving too quickly.

Vibe coding is not a fad but a fundamental shift in how software is created in companies.

The question for IT leaders is not whether to allow it — your teams are almost certainly already using it — but whether you will govern it before a breach forces the conversation.

By understanding how AI-generated code behaves, establishing clear human ownership, implementing automated security scanning, validating dependencies, and defining clear AI policies, enterprise leaders can encourage innovation while protecting corporate infrastructure.

The early-mover window for building governance is closing fast. Organisations that define their frameworks now will ship faster and more safely.

The organisations that treat governance as a strategic investment — not a compliance checkbox — will be the ones that capture vibe coding's productivity upside without inheriting its security debt. If you are ready to build an enterprise-grade AI coding governance framework, start by auditing your existing AI-generated codebase, mapping it to a risk tier, and aligning your controls with NIST AI RMF and OWASP's 2026 Agentic AI Top 10. The time to act is now, before the next incident makes the decision for you.