UK cyber agency warns on risks from AI-generated code

The UK’s National Cyber Security Centre has warned organizations that vibe coding, the practice of building applications through natural-language prompts while AI writes the code, can introduce serious security weaknesses when used without oversight. The agency said blind reliance on automated coding tools can expose companies to basic flaws, outdated dependencies and vulnerabilities generated by the models themselves.

The NCSC framed AI-assisted software development as a major shift for businesses, with competitive pressure pushing companies to adopt faster development methods. Its guidance urges technology leaders to avoid treating all AI-generated code the same, distinguishing between low-risk prototypes and critical software that supports large organizations.

Security controls are central to the agency’s recommendations. Companies are advised to make AI-driven changes visible, audit code before deployment, combine human and automated reviews, train teams to spot model hallucinations and apply strict policy guardrails by default. The NCSC said productivity gains from AI can be significant, but only if security teams retain strong control over technical review.