Vibe coding in the workplace: where to allow it, how to regulate it

Guide published on October 12, 2026, established from the recommendations of ANSSI and studies published on the security of AI-generated code.

Vibe coding is about creating software by describing it to an AI rather than writing it yourself. By 2026, a management controller, an HR officer, or a quality engineer could build in an afternoon the tool they'd been waiting for from the IT department for two years. Should it be banned, allowed to continue, or regulated? This guide explains what vibe coding is, what studies show about its risks, and the three-color framework we recommend for large organizations.

Vibe coding: the definition

The term was coined by Andrej Karpathy, co-founder of OpenAI, in February 2025: it described a way of programming where you express your intention to the AI ​​and accept what it produces, without necessarily reading the code. The Collins dictionary named it its word of the year for 2025 on November 6, 2025, defining it as a development method that transforms natural language into code using AI.

In the corporate world, the term has taken on a broader meaning: "vibe coding" is used whenever someone who isn't a developer has a tool built by AI. It's the successor to "citizen development" and low-code tools, with one major difference: there's no longer a platform limiting what can be done. The agent writes real code, which can do anything, including making mistakes.

Vibe coding tools

Family	Examples	Point of attention
Code agents	Claude Code, OpenAI Codex, GitHub Copilot in agent mode, Cursor, Mistral Vibe	They act on files and can launch commands: to be used with a business account and limited rights.
Application generation platforms	Lovable, Replit, Bolt, Base44	The application is hosted online by default: that's where published data leaks are concentrated.
Features integrated into the suites	App Builder in Microsoft 365 Copilot, Claude's artifacts	They remain within the company's environment; the risk becomes the proliferation of undocumented tools.

To choose between coding agents, see our comparison. Claude Code or Codex and our guide Claude Code in business.

What vibe coding really changes

• Prototypes in hours rather than weeks, to test an idea before mobilizing the IT department.
• Personal or team tools which replace a fragile Excel file, consolidate exports, automate a repetitive task.
• Better dialogue with developers : a working prototype is better than a set of specifications.

What you shouldn't expect: a critical application, connected to the information system and exposed to customers, built by a single person without review. This scenario always falls under the purview of a project managed by the IT department.

The risks, backed by figures

Veracode's 2025 report, which had over 100 templates complete 80 code tasks, shows that in 45% of cases, the templates introduced an OWASP Top 10 vulnerability. In May 2026, RedAccess identified 380,000 public applications and databases created with Lovable, Base44, Replit, or Netlify, of which approximately 5,000 exposed sensitive corporate information, according to VentureBeat. In July 2025, a Replit agent wiped a user's production database despite a freeze request.

These figures don't say that AI code is inherently bad. They show that it replicates known flaws when no one checks them. The five key risks to remember:

1. The exhibition : an application published on the internet without authentication.
2. The secrets : API keys or passwords written in the code or pasted into the conversation.
3. The data : personal data processed outside the GDPR register.
4. Irreversible actions : an agent that deletes or sends, based on real data.
5. The addiction : an indispensable tool that no one else knows how to maintain.

What ANSSI, the GDPR and the AI Act say

In October 2024, ANSSI and its German counterpart, the BSI, published a joint document on AI-powered programming assistants. They recommend using these tools only with the explicit consent of the company, reviewing and testing the generated code, ensuring control over what is sent to the software vendor, and being wary of code that may appear perfect but is actually flawed.

Under the GDPR, the rule is simple: any tool that processes personal data constitutes processing, regardless of how it was written. Regarding the AI Act, the obligation to control AI under Article 4, in force since February 2, 2025, also applies to builders; and an application that itself integrates AI, for example to sort applications, may constitute high-risk use.

Should it be prohibited, allowed to happen, or regulated?

Banning them doesn't work: the tools are free, accessible via a browser or already integrated into office suites, and usage is driven by personal accounts. Letting everything run its course doesn't work either: the first incident serves as a pretext to shut everything down. We recommend a traffic light system that prioritizes projects based on their impact and user base.

Level	When	What we are asking for
Green: we let it happen	Personal tool, fictitious or non-sensitive data, on the workstation	Respect the three prohibitions
Orange: a key contact person reviews	Team-shared tool, internal data, company environment	Review checklist and registration
Red: IT department approves	Sensitive or personal data, connection to the information system, internet exposure, embedded AI, decisions about individuals	Security review, DPO opinion if needed, commissioning decision

Two rules make this sorting effective: a single red criterion classifies the project as red, and a personal tool that begins to be shared automatically turns orange. It is at this precise moment that most tools fall off the radar.

The three prohibitions of the builders charter

• No secrets (password, API key, token) are entrusted to the agent or written into the code.
• No application can be published on the internet without company authentication.
• No personal, sensitive or confidential data is taken outside of the circuit validated by the IT department and the DPO.

Around these three prohibitions, a builders' charter defines the authorized tools, the work environment, verification procedures, the log, the production deployment, the end-of-life management of tools, and incident reporting. It must be two pages long: a charter that no one reads protects nothing.

Verify without knowing how to code

A builder doesn't need to read every line of code. They need to know how to check. The reflexes we teach:

1. Specify before asking : the problem, the user, the data, the expected result, what the tool should never do, three concrete examples.
2. Request a plan firstcorrect it, then build it step by step.
3. Working with fictitious data as long as the tool is not validated, and keep a version history.
4. Testing the borderline cases : empty file, very large file, duplicates, accents, dates in the wrong format.
5. Compare to a calculation done by hand based on a small sample.
6. Request a security review from the officer : secrets, access, seizures, dependencies, destructive actions.
7. Have a colleague test it who did not build the tool.

Get started in 30 days

• Week 1 : choose the authorized tools with the IT department, adapt the charter, define the workspace, appoint a contact person per pilot department.
• Week 2 : train 8 to 12 volunteer builders to specify, build, verify and classify.
• Week 3 : each person builds a team tool based on a real need, goes through the checklist and records it in the register.
• Week 4 : review of tools built and used, time saved and checklist items failed, then decision on expansion.

F.A.Q

Is vibe coding no-code?

No. No-code assembles building blocks provided by a platform. Vibe coding has AI write real code: it goes further, but without the safeguards of a platform, hence the need for rules.

Do you need to know how to program to do vibe coding?

Not to build a simple tool. But you need to know how to specify a requirement, test with edge cases, and recognize what needs to go through the IT department. That can be learned in a day.

Which tools should be allowed?

Those that the IT department can manage with corporate accounts: code agents under professional licenses, functions integrated into the office suite. Platforms that host the default online application require stricter rules, particularly regarding authentication.

Read also : Claude Code in business, Claude Code or Codex: which code agent to choose, Claude Skills: 10 skills ready to install et Cowork, Work, Vibe Work: Four ways to delegate work to AI.

Sources

• ANSSI and BSI, AI Coding Assistants, 4 October 2024
• Veracode, 2025 GenAI Code Security Report, July 30, 2025.
• VentureBeat, 5,000 vibe-coded apps just proved shadow AI is the new S3 bucket crisis, May 8, 2026
• eWeek, AI Agent Wipes Production Database, Then Lies About It, July 2025.
• Cloud Security Alliance, The Vibe Coding Governance Gap, June 2, 2026.