NewsPublished 15 Jun 2026

Vibe coders are gonna vibe code: How CISOs are tackling code sprawl

Source Bleeping Computer

Description

Employees are increasingly building automations, agents, and apps with AI tools outside traditional security oversight. Tines explores how CISOs are handling AI-driven code sprawl, shadow tooling, and governance challenges. [...]

Impact

The uncontrolled proliferation of AI-generated code and automations can lead to numerous unmonitored assets containing sensitive corporate information, increasing the risk of data exposure and operational security gaps. Lack of visibility and governance over these assets complicates incident response and risk management. The broad and imprecise permissions currently available for AI tools can allow excessive access, potentially leading to credential exfiltration or misuse. The phenomenon affects multiple organizational functions beyond engineering, including HR, marketing, and finance, where security awareness may be lower, further increasing risk.

Defensive guidance

Recommended mitigations include establishing comprehensive data classification to underpin controls, creating centralized internal marketplaces for AI tools to encourage governed usage, implementing use-case registries to link AI agents to accountable individuals, and focusing on enablement and training rather than restriction. Organizations should invest in technical controls that limit AI agents' access to sensitive credentials and advocate for more granular permission models from AI and cloud service providers. Continuous monitoring and codified governance integrated at the infrastructure level are essential to manage risks associated with AI-driven code sprawl.

Summary

The threat centers on the rapid expansion of AI-generated code and automations created by employees outside formal IT and security controls, leading to a visibility and governance crisis known as code sprawl or "vibe coding." A study found hundreds of thousands of publicly accessible assets built without security review, some containing sensitive data. Security leaders from major companies discuss challenges including the limits of policy-based governance, the need for data classification, centralized tool provisioning, and registries linking AI agents to human identities for accountability. They also note technical gaps such as insufficiently granular OAuth permissions and zero trust models that do not fully cover AI agents. The consensus is that organizations must enable safe, governed AI usage paths that are more attractive than shadow tooling, and invest in technical controls to prevent unauthorized access rather than attempting to block AI tool usage outright.

References

bleepingcomputer.com/news/security/vibe-coders-are-gonna-vibe-code-how-cisos-are-tackling-code-sprawl/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 15 Jun 2026, 14:15 UTC

References

Community reviews