Vibe coding with AI can feel like having a tireless robot buddy writing code for you – but even friendly robots can slip up. Go hands-on to learn more with DryRun at the RSA AppSec Village.
Ever built a feature by just telling Cursor, Windsurf, or ChatGPT what you want and trusting their code suggestions? If so, congratulations – you’re “vibe coding.” The term (coined by AI luminary Andrej Karpathy) describes letting AI-driven tools handle the actual coding while you fully “embrace the vibes” of prompt-based development. It’s incredibly fun and fast – imagine a pair-programmer that never sleeps. Karpathy joked that for quick projects he would even “Accept All” changes without reading diffs. Many of us have been there, riding the high of rapid development with AI assistance.
AI-Powered Coding: Great Power, Great Responsibility
The productivity boost from AI pair programmers is real. They can help generate boilerplate, suggest fixes, and even catch some bugs. In fact, we at DryRun Security are big fans of AI – our own Co-founder predicted that AI and LLMs will become indispensable in AppSec. But with great power comes great responsibility (yes, we went there). The hard truth is that AI doesn’t inherently prioritize security – it’s tuned to produce working code, not secure code. If you just trust the AI’s output without review, you might be quietly shipping some serious vulnerabilities along with your new features.
Think about it: an AI helper writes a database query for you in one shot. Awesome! But it might not use parameterized queries – boom, now you’ve got a SQL injection hole. Or it scaffolds a quick API endpoint that forgets an authorization check. Suddenly an attacker can skip the login and access data directly (classic auth bypass). We’ve seen AI-generated code that accidentally exposes object IDs without verifying user ownership – a recipe for an IDOR (Insecure Direct Object Reference) issue. These mistakes aren’t just theoretical. Security researchers have noted that AI suggestions often include things like hardcoded secrets or unsafe queries. As noted in the article above, “AI writes code that works, not code that’s secure”.
The bigger problem is us – developers may trust AI-generated code too much. Humans tend to take AI output at face value, not scrutinizing it like a coworker’s code. Skip code reviews and testing, and you’re essentially deploying whatever the AI thinks is best. (Spoiler: that’s how you get pwned in production.) Janet Worthington of Forrester cautions that even with AI coding assistants, you still need proper AppSec testing (SAST, dependency checks, etc.) to catch issues the AI missed. We couldn’t agree more. In our own journey building AI-driven security tools, we learned that rigorous testing and validation is the secret sauce to making AI coding safe. No free passes just because a machine wrote it!
See “Vibe Coding Gone Wrong” Live @ RSA 2025
Want to see what happens when you fully give in to the vibes without a security net? Come check out DryRun Security’s interactive demo at RSA 2025’s AppSec Village: “Vibe Coding Gone Wrong: Can You Catch the AI’s Mistakes?” We’ve prepared some AI-generated pull requests full of sneaky security bugs. Your mission: play code detective and spot the vulnerabilities (think SQLi, auth flaws, etc.) before they make it into production. It’s a fun, hands-on way to learn just how easily an unchecked AI suggestion can slip a bug past even seasoned devs.
AppSec Village Schedule:
- April 28: 11:30am–1:30pm
- April 29: 1:30–3:30pm
- April 30: 11:30am–1:30pm
We invite developers and security pros alike to swing by during the above times, put your secure code review skills to the test, and chat with us about all things AI and AppSec. AI-assisted development isn’t a hype train to jump off – it’s the future. But it works best when we keep our security glasses on. So grab a coffee at RSA, then come by our booth to see vibe coding’s pitfalls up close and learn how to code with AI securely. Don’t let the AI have all the fun (or introduce all the bugs) – join us and level up your secure coding vibes. See you at the demo!
