National Cyber Security Centre, June 2026
The UK’s National Cyber Security Centre (NCSC) has written about vibe coding, with small and medium-sized organisations among its intended readers. It doesn’t tell you not to do it. It asks you to think about what you’re building.
Where does your app sit?
| Probably fine with a light touch | Needs real safeguards |
|---|---|
| A demo to show people an idea. An internal tool with limited risk, such as a staff rota with nothing sensitive in it. A public page with no logins and no data. | Anything with logins and permissions. Anything holding personal details. Anything using secret keys or connecting to your other systems. Anything where a flaw would seriously hurt your business. |
That second column is based on the NCSC’s list, which is about building authentication, processing sensitive personal data, handling secrets, and cases where a flaw’s consequences would be significant. In those cases, it says you should review what the AI produces, understand the code, check for vulnerabilities, and verify that it does what you expect.
Now the awkward bit. Many home-grown systems start in the first column and quietly move into the second. A handy tool gets a login, then customer details, then a link to the accounts system. Nobody ever decides to take on the risk. It just arrives.
What the NCSC says about non-technical builders
In a separate article, the NCSC’s CTO for Architecture wrote that “someone with little or no technical experience tends to find it creates code they never could, but it’s often unreliable, hard to maintain, or has critical issues.” He’s also optimistic about where it’s heading, and the NCSC encourages people to engage with it. It’s a fair picture: remarkable, useful and not yet safe to leave unsupervised.
What the numbers really show
You’ll see a lot of statistics about this. Most are less solid than they look, so here’s our honest reading.
91% of 200 apps
A 2026 study randomly sampled 200 deployed open-source apps built with AI tools, and found at least one vulnerability in 182 of them, about two-thirds of the flaws rated critical or high. It’s the best app-level figure we found, but it’s a preprint, and these were open-source apps, not private business systems.
About 38% of tasks
Veracode’s autumn 2026 testing found AI models introduced a vulnerability in about 38% of coding tasks, improving from about 44%. It only tests four kinds of weakness, and Veracode sells scanning. You may see an older 45% quoted.
More confident, less secure
A Stanford study found people with an AI assistant wrote less secure code than those without it, and were more likely to believe it was secure. It’s small and dates from 2022, but it rings true.
Watch out for 91.5%
This widely repeated figure traces back to one firm’s blog about apps brought to it by worried customers, measured with its own term. It says little about apps in general.
None of these can tell you the chance of your app being attacked. Nobody has measured that, and we’d distrust anyone who claims they have. What they do show is that serious flaws are common enough that you shouldn’t assume your app doesn’t have any.
Why it’s so hard to tell by looking
An insecure app looks exactly like a secure one. Every screen loads and every test passes. The tools are built to produce something that works, and Vercel’s own security team puts it this way: “AI tools are trained to generate code that runs, not to make it secure.” The usual failures are invisible from inside the app: missing access rules and exposed keys.
Security is only half of it
Even a perfectly secure app can leave your business exposed. The NCSC notes that a vibe-coded code base can become “complicated and confusing to understand, leading to further issues down the road with maintainability.” If only one person understands it and holds the logins, you have a key-person risk as well, and in our experience that’s what really keeps owners up at night.
What to do
- Work out which column your app is in, honestly, as it is today.
- Do our 10 checks. They only take an afternoon.
- If it’s in the second column, have someone independent look at it. That might be a developer you trust, or an audit like ours. Here’s how to choose.
Questions
Did the UK Government say vibe coding is an “intolerable risk”?
You’ll see this claimed. An NCSC news release in March 2026 said AI-produced code “currently poses intolerable risks for many organisations”, while also saying that vibe coding shows glimpses of a new paradigm. It’s not a blanket warning against it, and the NCSC says it can be fine for lower-risk uses.
Does my AI tool’s security scan mean I’m safe?
It’s worth running, but the tools themselves say it isn’t enough. Lovable says its tools “cannot guarantee complete security” and Replit says “no scan guarantees that your app is secure”. A scanner can’t know who should see what in your business.
Sources
By Selwyn Doling, VibeTend. Last updated 6 November 2026.
