Vibe Coding Promised Instant Software. It Also Delivered Instant Risk

In July, researchers at Wiz uncovered a flaw inside Wix’s Base44 platform that let attackers bypass authentication and access private corporate apps using nothing more than a public app ID.

The discovery was straightforward, and that was the problem. As Wiz put it, the exploit “required only basic API knowledge,” meaning anyone could replicate it across multiple apps. Wix fixed the issue within 24 hours, but the incident showed how fast AI-driven development can outpace its own guardrails.

Other companies have faced similar exposure. The AI-powered chatbot firm Drift recently suffered a breach that exposed Salesforce data belonging to major clients, including Cloudflare and Google. Wiz’s chief technologist, Ami Luttwak, said the attackers used AI-generated code to steal digital tokens and impersonate legitimate software bots. “The game is open,” Luttwak told TechCrunch. “If every area of security now has new attacks, then it means we have to rethink every part of security.”

These incidents, combined with a stream of research showing AI-written code still riddled with classic bugs, have triggered a rush to rebuild security for the AI-coding era.

Security at the speed of AI

This week, Boston-based security company Snyk and San Francisco’s Cognition announced a partnership designed to make security run at the same speed as AI coding agents. The companies are integrating Snyk’s real-time scanning and automated remediation tools directly into Cognition’s AI developer agents, Devin and Windsurf.