You are just like me The majority of software developers won’t start from the beginning when creating a project. They don’t even grind and grow wheat for their bread. It would be very slow, and it could cause more security problems. So developers draw on existing libraries—often open source projects—to get various basic software components in place.
Although this method is effective, it may create a lot of exposure as well as obscurity in the software. Increasingly, however, the rise of vibe coding It is also being used to allow developers to create new applications. quickly spin up code They can adapt the code rather than having to write it from scratch. Security researchers warn, though, that this new genre of plug-and-play code is making software-supply-chain security even more complicated—and dangerous.
“We’re hitting the point right now where AI is about to lose its grace period on security,” Alex Zenla says that Edera’s chief technology officer, Alex Zenla. “And AI is its own worst enemy in terms of generating code that’s insecure. If AI is being trained in part on old, vulnerable, or low-quality software that’s available out there, then all the vulnerabilities that have existed can reoccur and be introduced again, not to mention new issues.”
The reality is that, although it can be used to collect potentially unsafe training data for AI models, vibe coding produces code in a very rough form that does not always take all relevant context or considerations into account. Even if an AI model is trained on the source code of a given project and natural language descriptions of its goals, the final product still relies on humans to identify any flaws or anomalies in AI-generated code.
“Engineering groups need to think about the development lifecycle in the era of vibe coding,” Eran Knsbruner says he is a researcher for Checkmarx, an application security company. “If you ask the exact same LLM model to write for your specific source code, every single time it will have a slightly different output. One developer within the team will generate one output and the other developer is going to get a different output. So that introduces an additional complication beyond open source.”
Checkmarx survey In 2024, more than half of all code generated in an organization will be AI-generated, according to a third respondents. This includes chief information officers, managers of application security, and directors of development. However, only 18% said their company had a list approved for vibrancy coding. Checkmarx polled thousands of professionals and published the findings in August—emphasizing, too, that AI development is making it harder to trace “ownership” The code.
