Sep 4, 2026 · 16 min · 10 segments
Infosec Decoded Season 6 #59: Vibe Coding’s Security Debt With sambowne@infosec.exchange Links: https://samsclass.info/news/news\_090426.html Recorded Fri, Sep 4, 2026
Sam BowneHost
This report says that AI-assisted developers produce commits at three to four times the rate of their peers, but they introduce security vulnerabilities at 10 times the rate, creating a security debt that accumulates faster than organizations can remediate it, which seems very logical.
If you work for a company that writes software, which is practically every company now, then you don't want code as fast as possible, you want good code.
And this is why I saw articles that say 95% of the companies that tried to replace people with AI have not seen a return on investment from doing that because it's a very foolish plan.
And you will learn how stupid it is and how it is not remotely replacement for a human.
So I was very pleased to see one thing I've been saying a lot about, harping on everywhere I go, is that AI agents are extremely dangerous.
And if you let them have credentials, they can make purchases, make reservations and all that.
And they might find instructions on a web page or in your email and think that came from you and execute it.
So the defense, one defense is try to train your AI model to not... do those bad things.
And of course, as tested, that doesn't work at all because AI models don't really obey anything they've been trained to do all the time.
So you need a strong security barrier somewhere, and there are two or three companies that have already announced they're working on those security barriers.
This report says that AI-assisted developers produce commits at three to four times the rate of their peers, but they introduce security vulnerabilities at 10 times the rate, creating a security debt that accumulates faster than organizations can remediate it, which seems very logical.
If you work for a company that writes software, which is practically every company now, then you don't want code as fast as possible, you want good code.
And this is why I saw articles that say 95% of the companies that tried to replace people with AI have not seen a return on investment from doing that because it's a very foolish plan.
And you will learn how stupid it is and how it is not remotely replacement for a human.
So I was very pleased to see one thing I've been saying a lot about, harping on everywhere I go, is that AI agents are extremely dangerous.
And if you let them have credentials, they can make purchases, make reservations and all that.
And they might find instructions on a web page or in your email and think that came from you and execute it.
So the defense, one defense is try to train your AI model to not... do those bad things.
And of course, as tested, that doesn't work at all because AI models don't really obey anything they've been trained to do all the time.
So you need a strong security barrier somewhere, and there are two or three companies that have already announced they're working on those security barriers.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.