Do you need help & advice with AI & Automation?
Dave built a small tool for his own website using AI. It worked. It logged what visitors typed in, which is what he asked for.
It also stored all of it in a completely public place that anybody could read. Nothing in the code secured it, and nothing in the process flagged that. He only found out because he thought to ask the question: are these logs private, or could anyone just get at them?
Had he not asked, he would have put it live, it would have worked perfectly, and he would have had a GDPR breach from day one.
What is vibe coding?
Describing what you want software to do in plain English and letting AI write the code.
You do not need to be a developer. You explain the outcome, it produces something, you try it. When it does not work you say so and it has another go.
The barrier to entry is now zero, which is brilliant. Somebody in your business who has an idea for a small tool can build it this afternoon instead of putting it on a list that never gets funded. That is a real gain and this article is not an argument against it.
So what actually goes wrong?
It builds something that works. Nobody asked it to build something safe.
That is the whole problem in one line. AI writes code that does the job you described. Security is not part of the job you described, so it does not appear, and nothing tells you it is missing. The thing runs. It looks finished.
| What you see | What is underneath |
|---|---|
| It works | Data stored somewhere anyone can read |
| It is fast to build | No limits on who can use it or how often |
| It does what you asked | Credentials sitting in plain text in the code |
| It looks tidy | The same thing declared four times, and a lot of code doing nothing |
That last row matters more than it sounds. Inefficient code is not just untidy, it is harder for anyone else to check later, and it is where the surprise bills come from.
The bills are the part nobody expects. An AI-built app with no limits on it, connected to a paid service, can run up tens or hundreds of thousands of pounds if it gets stuck in a loop or somebody finds it and hammers it. This has happened to real businesses. Nobody set out to spend that money.
Where is the line?
Whether it holds anything that belongs to somebody else.
That is the test, and it is simpler than any list of rules.
| Go ahead | Get it looked at first |
|---|---|
| A tool that reformats your own spreadsheet | Anything a customer or subcontractor types into |
| Something on your own machine, for you | Anything holding names, contact details or prices |
| A prototype to show people the idea | Anything reachable from the internet |
| An experiment you will throw away | Anything connected to a system that costs money per use |
| Automating a job you already do by hand | Anything that will still be running in six months |
The left column is where vibe coding earns its place. Fast, cheap, genuinely useful, and if it breaks nobody outside the business notices.
What does “get it looked at” actually mean?
Somebody who can read code spends twenty minutes on it before it goes live.
Not a full security audit. Not a development project. A cursory glance by somebody who knows what they are looking at catches the great majority of this, because the failures are not subtle once you know to look.
Five questions worth asking of anything before it goes live:
| Ask | Why | |
|---|---|---|
| 1 | Where is the data stored, and who can read it? | The exact question that caught Dave’s public log store |
| 2 | Are any passwords or keys written into the code? | Extremely common, and it means anyone with the code has the keys |
| 3 | Can anyone use this, or only the people who should? | AI rarely adds a login unless told to |
| 4 | What is the worst it could cost if it runs out of control? | Set a spending cap before, not after |
| 5 | If this breaks in six months, who fixes it? | The person who built it may not be able to read it either |
What about tools that just talk to AI?
Same problem, different shape. Whatever that system can reach, the AI can leak.
Businesses are wiring AI into things without any controls around it. The risk is not that the AI turns malicious. It is that it has access to more than anyone intended, and it will happily use all of it to answer a question.
Designing around that is genuinely difficult, and it is not something to work out as you go. If nobody in the business can explain what the thing can reach, it is not ready to be live.
[VIDEO_PLACEHOLDER]
So, what now?
Find out whether anybody in your business has already built something this way. Not to tell them off. It is a good instinct and you want more of it, not less. Ask the five questions above about anything that is live.
Then agree the line: internal and disposable, go ahead. Anything holding somebody else’s information gets twenty minutes from someone who can read code.
If you would rather have somebody keeping track of what is being built and what it can reach, that is part of what an AI Manager does. The wider basics are in getting started with AI in your business.
Frequently asked questions
What is vibe coding?
Describing what you want software to do in plain English and letting AI write the code.
You do not need to be a developer. Genuinely useful for small internal tools and prototypes, and risky for anything holding other people’s information.
Is AI-generated code secure?
Not by default. It writes code that works, and security is not part of “works”.
Unless you specifically ask for it, expect no access control, no limits, and data stored wherever was easiest. It will not warn you about any of that.
Can we use AI-built tools in our business?
Yes, and you probably already are. The line is whether it holds anything belonging to somebody else.
Internal tools, prototypes and things you will throw away: go ahead. Anything customer-facing, internet-reachable or holding personal data needs twenty minutes from somebody who can read code.
Could AI-generated code cause a GDPR breach?
Yes, and it is one of the easier ways to have one without noticing.
If a tool stores what people type into your website somewhere publicly readable, that is a breach from the moment it goes live, whether or not anybody finds it. The tool will work perfectly throughout.
Why do AI-built apps run up big bills?
Because nothing limits how often they run or who can use them.
Connect one to a paid service, let it loop or let a stranger find it, and the charges are per use. Set a spending cap before it goes live rather than after the invoice arrives.
Last reviewed: 17 August 2026.
Related
- Why AI gets things wrong
It is trained to sound confident rather than be right. - Who actually owns AI risk in your business
The silence at the management meeting, and who the job should go to.
