Faster code without stronger review is just faster security debt

What happened

A research note from the Cloud Security Alliance’s AI Safety Initiative, “Vibe Coding’s Security Debt”, pulls together the evidence on security in AI-assisted development. It is not comfortable reading, and it has only become more relevant as agentic coding tools have moved from individual experiments into team-wide adoption.

The note cites enterprise analysis finding that AI-assisted developers commit several times faster than their peers while introducing security findings at a far higher rate, with privilege escalation paths and architectural design flaws both rising sharply. It references Veracode testing across more than a hundred models in which a large share of generated samples introduced OWASP Top 10 vulnerabilities, with no improvement across testing cycles. It highlights supply-chain risk from hallucinated packages — dependencies that do not exist, which attackers can register — and a perception gap: most developers believe AI generates more secure code than humans, and those using it submitted less secure code with greater confidence.

The recommendations are practical: audit which AI coding tools are actually in use, restrict AI assistance on security-critical code, move security testing into the development workflow, treat coding agents as non-human identities, and extend software bills of materials to record AI provenance.

Why it matters

The headline finding is not that AI writes bad code. It is that the bottleneck moved and the controls did not.

For decades, writing code was the slow part, and review, testing and security scanning were sized for human output. Generation is no longer slow. A team that triples its commit rate without changing how it reviews has not become three times more productive. It has tripled the load on a review process that was already the thinnest part of the pipeline, and it is approving changes with more confidence and less scrutiny.

This is why we describe our own approach as hive code, not vibe code: senior engineers, AI engineers and supervised agents working one backlog, with review gates no generated line skips.

What we would do

1. Find out what is actually in use. Survey teams and check endpoints and repositories for AI coding tools, sanctioned or not. You cannot govern what you have not found.
2. Start every agent task from a specification. Acceptance criteria and tests are written first, so generated code is checked against something objective.
3. Draw a line around security-critical code. Authentication, authorisation, cryptography and input validation get mandatory senior human review, whatever produced the change.
4. Move security left of the pull request. Static analysis, secret scanning and dependency checks run in the developer’s loop and in CI, with a dependency allow-list to catch hallucinated packages.
5. Record provenance. Signed commits, a software bill of materials, and a marker on changes that were machine-drafted, with the name of the person who approved them.
6. Measure both sides. Track delivery speed alongside security findings and change failure rate. If one improves while the others worsen, the gain is not real.

Used this way, AI coding agents are a genuine step change. Used without it, they are a faster way to accumulate debt someone else will pay.