Vibe Coding Through
a Security Lens
What a cybersecurity trainer learned building with AI
Written by:
Consultant
Sapience Consulting
If you’ve spent any time online lately, you’ve probably seen the headlines. Someone with little coding experience builds in a few days what would once have taken a full-time developer months. A teenager vibe codes a Mac driver for a printer that only ever supported Windows. Depending on who you ask, vibe coding is either the future of software development or a security incident waiting to happen.
As a cybersecurity trainer and consultant with Sapience Consulting, I hear both views regularly. So I decided to stop reading about it and try it myself. I last wrote code seriously two decades ago: Java at polytechnic, Python at university, and some VBA automation in a later role. I’m not a developer by trade, which made me a fair test subject.
My experiment with Claude Code, an AI coding assistant, turned into something much bigger than I expected. In this article, I’ll share what I built, where my security instincts kicked in, and the practical lessons individuals and organisations should consider before adopting vibe coding.
From Curiosity to Resurrection
I started with a deliberately tricky challenge. Could Claude Code build a game trainer (a small tool that changes a game while it runs, such as giving unlimited lives) for an old Windows 9x game without any documentation on how the game worked? After we worked around a few bugs, it did. Encouraged, I went further. I used AI to enhance the game’s dated bitmap graphics while keeping its original look and feel. Then I revived other childhood favourites that no longer run on Windows 10 or 11 without a virtual machine.
What surprised me most was that Claude Code found the root causes of bugs that had been in these games since release, and fixed them with some prompting and feedback. It felt less like being the programmer and more like working closely with a highly skilled one. My coding background helped me follow its reasoning, even if I wouldn’t have had the skills or patience to do the work myself.
When the Expert Becomes the Beginner
The turning point came when Claude Code proposed patching the game executables at the binary level to fix certain bugs. I understood the gist of the changes. Honestly, though, I didn’t have the depth to know for certain whether they were safe. The fixes worked. But in that moment I realised this is how someone without a technical background feels on even simple tasks: completely reliant on the AI and hoping for the best.
“Completely reliant on the AI and hoping for the best.”
Two other moments stood out.
Defence in depth works
Windows Controlled Folder Access, which I had set up beforehand, blocked some of Claude Code’s actions until I granted access manually. It was mildly inconvenient, but proof that defence in depth works, even against your own AI assistant.
No questions asked
A game trainer manipulates another program’s memory much as some malware does, yet Claude Code never asked why I wanted one. That’s worth thinking about.
Treat Your AI Like a Vendor
My biggest lesson will be familiar to anyone who has managed third-party IT vendors: be specific about your requirements, both functional and non-functional. Claude Code won’t build security controls you never asked for, and someone without security knowledge may not know what to ask for.
“That gap, more than the tool itself, is where the real risk of vibe coding lies.”
AI also makes mistakes. Claude Code sometimes confidently proposed fixes that failed or broke something else. Then again, so do human programmers. The remedy was the same as with a person: verify its findings and pass on observations it couldn’t make itself, so it could quickly rule out false conclusions.
Vibe Coding Security: What Organisations Should Do Now
If your staff are starting to vibe code internal tools, here’s where I’d begin:
01. Set the policy
Address vibe coding explicitly, whether in your AI policy or your IT acceptable use policy. You can’t fault employees for breaking a rule that was never written.
02. Approve your platforms
State clearly which AI coding tools are permitted and which aren’t.
03. Mandate and verify controls
Keep organisational visibility over your development, test and production environments.
04. Keep reviewing code
Never assume AI-generated code is sound or safe. If manual review can’t keep pace, at least have a different AI model cross-check the output.
None of this is new. These are cybersecurity and governance fundamentals applied to a new way of working, which is exactly why they matter more than ever.
Final Words
Vibe coding is not a gimmick. In my experience, it’s like having a very experienced programmer on call, able to do work that once needed a dedicated development team. But like any new hire, however talented, it needs clear requirements, appropriate access and someone checking its work. My advice to anyone starting out is simple. Tell it exactly what you need, including the security controls. Verify what it delivers. And never assume mistakes can’t happen just because AI wrote the code.
The skills that make AI adoption safe aren’t new, but they now apply to a new kind of risk. Someone has to secure AI, assess the risks it introduces and check that the controls actually work. ISACA’s AI credentials cover all three:
AAISM
Advanced in AI Security Management
For security leaders managing AI risks and control.
SFC
PSEA
UTAP
Course funding available. All three courses are eligible for SWDA course fee funding, and you can use SkillsFuture Credit. PSEA and UTAP can also be used for AAISM and AAIA. Check your eligibility.
I hold all three myself, and they address exactly the gaps this experiment exposed. At Sapience Consulting, we offer training for each, along with audit and consulting engagements for organisations that want an independent view of their AI adoption.
Make the most of AI, safely
Find out how we can help you and your organisation adopt AI with the right security, risk and audit skills in place.
Get in touch with our teamCheck out our IBF and SSG funded courses! There is no better time to upskill than now!
IBF Funding
IBF Funding
