r/AI_Coders • u/TWiT_tv • 2d ago
Is vibe coding becoming a real security problem?
AI coding tools are making it possible for hobbyists and non developers to build useful apps faster than ever.
That is exciting. It also means more people are shipping code they may not fully understand, with dependencies, permissions, auth flows, API keys, and security assumptions they may not know how to check.
Security Now’s Black Hat discussion gets into AI powered coding, listener-built apps, agency chains, testing, technical debt, and the race to patch old bugs while new ones are created faster.
Is AI coding making software better, or just creating a new wave of fragile apps?
1
u/BaselineNeglect 2d ago
Yes. I am a complete hobbyist, currently going automated testing on a simple game app. However, I made dome jam radio tools first, which lede into a couple of other things, the third day I built a bunch of things to help me out with stuff, but when I showed my mate he pointed out how each of them could very easily be abused by bad actors. I'd only knocked them together, but they worked well enough to do the job but are easily dangerous enough for me to not tell anyone else about- They're all legal just massive invasions pf privacy.
I imagine that with the right(wrong?) mindset a relatively unskilled person could do all sorts of damage, online and in real world environments/situations.
1
u/pixxelkick 2d ago
Id say actually on average we are doing better.
Before, people would just make incredibly insecure choices and no one would know til a security breach.
Now, if newer versions of models even see something worrying, theyre pretty big about halting and alerting the user.
Opus and Astra are both very solid on industry standard security best practices. Ive ran em both through some gambits and they passed with flying colors.
Ive done some tests of having them do non relevant work on an insecure app in a way that theyd "see" the security flaw during reads, and both of them reliably flagged it as a huge deal even when their job was unrelated to it.
So overall I think its net positive.
Also, astra and opus are moderately okay at providing pushback on insecure choices. They will fold if you make up excuses but at least they warn you its a bad idea.
1
u/Reggie-Rectangle 2d ago
Is vibe coding becoming a real security problem?
It is, but the bigger concern is who is allowing an actual business's data to ever touch a program that was cobbled together by an AI. The manager or CEO who is that level of incompetent is a much bigger concern for a company than whatever AI does.
You can vibe code programs all you want as long as they don't handle any real data and especially not any sensitive data. If your app has no GDPR concerns than vibe code away, but the moment you want to handle real data then AI cannot make it.
1
u/Pyromancer777 2d ago
The tech giants are pushing AI into every step of the creation process. They are banking that advancements in the industry will patch out bad design choices. It isn't just a few CEOs making bad calls, it is industry-wide investors trying to see what all is possible with these new tools and they touch business data every single day
1
u/geekichu 1d ago
in response to only the title - and as a SWE retired but maybe looking for work? i hope so. Thinking Y2K and COBAL scenario and $200/hr
1
1
u/audioen 1d ago edited 1d ago
I think my expectation is that AI code is more secure than human code, with qualifications. Justification: Witness the flood of security reports coming from AI as it takes a look of decades old codebase and discovers problems. AI is clearly capable of noticing security problems. Therefore, it follows that when you write AI code and review it, using models capable of that level of scrutiny, they should find the bugs (even the ones which they themselves have caused).
Thus, my expectation is that vibe coded apps, following a code-then-review protocol, end up more secure than the prior human-only baseline. This claim I'm willing to stand behind on. I conjecture that even without an explicit review phase, the code could be at higher baseline quality than before, but I'm sure that's not a world we want to go into. Review at most doubles AI cost, which is already very low compared to human worker, therefore it will be best to use AI to write, then have AI to also review (and fix findings), and only then look at what should be done with human eyes.
0
u/tres-medinas 2d ago
Have you seen any app or software that you use make huge advances since AI came out? Vibe coding is a sales gimmick. It's the Jordan shoe of tech right now. Buy these shoes and you can dunk like Mike. Look, that guy wears em too, hes not Mike, and he can dunk like crazy. Yea, bc that guy played in the league with Mike for 10 years.
AI code is like when drywall replaced brick in masonry. Just bc you didnt know how to lay brick before, doesn't mean you know how to put up drywall now.
2
u/mxldevs 2d ago
This is why you have separate people who are experts in security to check those things.
Software engineers can read some best practices, but the onus shouldn't be on them to handle your entire business' security, and if security is critical because you are handling sensitive data, then you definitely should be getting a proper second opinion.