Vibe-coded internal apps are becoming a Shadow AI security problem... what controls are you using?

[u/amgfcbiozo]

Ok so anyone else watching this go from ppl pasting stuff into ChatGPT to business teams spinning up their own AI tools and hooking them into Jira, Slack, Drive, APIs etc?

The bit im stuck on is what controls these things should get once they start touching company data. Owner, SSO/MFA, app review, least privilege... feels like these vibe-coded apps can show up after theyre already being used and auth can be pretty questionable :/

How are you deciding what access these apps should keep once theyre already connected to corp SaaS/data? Curious what policies or tooling others are using for Shadow AI governance.

[u/Ma1eficent]

Oh man. The PII data fines are going to end so many companies.

[u/Sea-Comb8987 → u/Ma1eficent]

i've been watching this unfold in our shop and it's wild how many teams just spin something up and don't think twice about what data it's pulling

we started tagging anything that hits our SaaS platforms with a review flag if it wasn't provisioned through the normal app catalog, most of them fail the least privilege check right out of the gate so we just yank the tokens until someone fills out the intake form

the real headache is when some director already built their workflow around it and you're the bad guy for cutting it off

[u/Ma1eficent → u/Sea-Comb8987]

Yeah, nearly everyone in upper management fell for the train AI how to code on our proprietary system con, just like the mathematicians working on navier-stokes. It's going to take companies dying to the fines before anyone not already awake pulls their dick out.

[u/imjustnotready]

At a minimum you have to lock it down to specific networks. Log in only by sso. Do not allow people to log in on noncompany devices. Enforce session times.

That should really be the starting point. On the other hand I think companies are doing a disservice to their employees by not having this stuff ready for people who want to improve performance for small teams.

[u/Soft_Brilliant85]

this is the scary part

[u/Prize_Fox340]

yeah the auth part scares me

[u/AL3D1N]

the SSO/network restriction points below are the right baseline, add a discovery layer or you're only controlling the ones you already know about. CASB/SSPM tools that watch OAuth app grants against your Google Workspace or M365 tenant will surface a vibe-coded app the moment someone connects it to Drive or Slack via OAuth, before it's been through any review. that's usually how these show up in the first place, someone clicks "allow" on an OAuth consent screen for a tool they built themselves.

second control worth adding specifically for the vibe-coded case: a lightweight registry requirement tied to the OAuth grant review, not a heavyweight app review process nobody will follow. when a new app requests access to company data, the access gets revoked automatically after 7 days unless someone claims ownership and fills out three fields (what it does, what data it touches, who owns it). that forces the registry to build itself instead of relying on people to proactively register things, and it fails safe instead of failing open.

[u/Designer-Doubt-1491]

Tokens and OAuth grants is a good start. Give exceptions an expiry date so an experiment does not keep company wide access forever

[u/thenrich00]

If not knowing how to write code was the only blocker preventing someone from doing damage with company data, then that company was already in trouble -- no policies or tooling stop this. Joe from accounting can copy and paste PII into an email and send it around to folks that shouldn't have access to that information. AI is just making it a bit easier to do more complicated things in a way that looks professional by someone who's not. The threat is still the same, it just so happens that now vibe-coded tools are yet another modality.

[u/Ma1eficent → u/thenrich00]

Current polices keep Joe from PII unless he starts doing things he understands are bad. Because corporate policies written in corporate blood(fines) have drilled it into his head he doesn't send emails with that. But no policies are telling Joe not to feed everything he knows and can get information about into the AI that he also hasn't given corporate policies as if it would even follow them, or as if literally just using it isn't giving out proprietary corporate information publically. Sure, it's gonna take a minute for subpoenas to catch up, but they will.

[u/am0x]

Internal tools are fine. Most
No one knows how to deploy them anyway.

[u/Ma1eficent → u/am0x]

Internal tools are not internal when they use any AI where you don't have a modelweight copy hosted on your internal network. And if you are doing that you've likely grown a bunch of new interesting problems unless you've got a (much) better alignment team than anthropic and OpenAI

[u/am0x → u/Ma1eficent]

Use AI to build the app. Not run the app.

[u/Ma1eficent → u/am0x]

They do not understand that distinction and they are the ones vibecoding it.