AI-written code is now everyday reality, also outside IT departments. What it means for the board, where the risks are, and which rules to put in place before a prototype reaches production.
What vibe coding is
The term “vibe coding” was popularised by Andrej Karpathy in February 2025. He used it to describe a way of working where, instead of writing code line by line, you describe to an AI model what you want, accept what it generates, and refine the result with further prompts. Originally it was about quick experiments and prototypes. A year and a half later, this approach is already inside companies — and not only in IT departments.
From an IT director’s perspective, that is both good news and a reason for concern.
Why this is a board-level topic, not just a developer topic
The scale is already significant. According to the Stack Overflow Developer Survey 2025, 84% of developers use or plan to use AI tools, and roughly half use them every day (via ITwiz).
More important, however, is who writes code today. Platforms that turn a plain-language description into a working application mean that a reporting tool, a simple ticketing system or an automation can now be built by an analyst, an accountant or a shift manager. That is enormously valuable — the people who know a process best can improve it themselves.
But it is also a new version of a familiar problem: shadow IT. This time it is not a spreadsheet with a macro, but an application with access to customer data, exposed to the internet, that the IT department does not know exists.
Where the risks are
Security
AI-generated code looks correct and usually works — which does not mean it is secure. In Veracode’s 2025 GenAI Code Security Report, models introduced a vulnerability from the OWASP Top 10 in 45% of tasks, with protection against XSS and log injection performing worst. Notably, according to the next edition of the report, newer and larger models did not clearly improve on this result (via ITwiz).
Quality and technical debt
AI writes a lot, and fast. Without a shared architecture, the result is redundant, duplicated and inconsistent code that works today but is expensive to maintain a year from now. The problem surfaces with the first serious change — when nobody in the company understands how the application actually works.
Tests that create a false sense of security
Tests generated by the same model that wrote the code usually check the “happy paths”. A green bar says nothing about what happens with invalid data, an unusual user or a deliberate attack.
Non-determinism
The same task description can produce slightly different code each time. Models can also “hallucinate” — using libraries or functions that do not exist — and take shortcuts to formally reach the goal.
Data and intellectual property
Every prompt sent to an external AI tool is data leaving the company. If an employee pastes extracts from the customer database or ERP source code into it, you should know where that data goes and under what terms. On top of that come open questions about licensing and ownership of generated code.
Accountability cannot be delegated to a model
This is the most important point in the whole debate. Vibe coding lowers the barrier to building software, but it does not transfer accountability. A customer, auditor or regulator does not ask whether the code was written by a person or a model. They ask who signed off on the product.
In many companies, there is also a regulatory context. Poland’s Act on the National Cybersecurity System, which implements NIS2, explicitly makes management responsible for security — I wrote about this in NIS2 for mid-sized companies: where to start. An application built “quickly” with AI that processes data in a key business process belongs to that scope just as much as a system bought from a vendor.
It is also worth keeping some distance from the vision of fully autonomous agents. Capgemini Research Institute’s Rise of agentic AI study (July 2025) found that executives’ trust in fully autonomous AI agents fell within a year from 43% to 27% (via ITwiz).
Rules worth putting in place
Banning vibe coding makes no sense — people will use it anyway, just outside any control. It is better to agree simple rules of the game:
- Separate prototypes from production. A prototype, an internal tool for one team or a one-off analysis can be built quickly. Anything that touches money, personal data, customers or core systems goes through the normal delivery process.
- Requirements first, code second. A few sentences on what the application should do, for whom and with what data save weeks of rework.
- Code review and automated scanning. All code going to production — whoever or whatever wrote it — goes through code review and security scanning (SAST, dependency analysis).
- Negative tests. Test invalid data, missing permissions and attack attempts, not just the scenario where everything goes right.
- Approved tools and data rules. A clear list of AI tools people may use, and clear guidance on what data must never be pasted into them.
- An owner for every solution. Every application has a person who is responsible for it, understands what it does and knows whom to contact when something goes wrong.
- Training. Not in prompting, but in the basics: security, data, and when to call IT.
Where vibe coding really works
In my view, it delivers the most value where speed matters and the cost of a mistake is low: prototypes for conversations with the business, internal tools, automating repetitive tasks, data analysis and proofs of concept before a bigger investment. Where money, reputation or regulatory compliance are at stake, AI is an excellent support for the team — but it does not replace engineering and human oversight.
Summary
Vibe coding is not a passing fad. It is a change in how software is built that gives companies a real advantage — as long as it comes with clear rules. Faster does not mean less accountable. It means accountability has to be well organised.
Sources
- Vibe coding podbija rynek, ale odpowiedzialność człowieka jest ważniejsza niż kiedykolwiek — ITwiz, 14 October 2026 (in Polish) (partner content — Capgemini Poland); the Stack Overflow Developer Survey 2025, Veracode GenAI Code Security Report and Capgemini Research Institute Rise of agentic AI figures are cited via this article.
✦ This text was prepared by an AI agent and reviewed by the author before publication.