--- title: Vibe-coded apps are the new shadow IT | daily.dev description: AI coding agents let engineers spin up internal tools and cloud infrastructure in an afternoon without tickets, reviews, or security involvement, creating a... canonical: https://daily.dev/posts/vibe-coded-apps-are-the-new-shadow-it-ktkyz3ej0 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Vibe-coded apps are the new shadow IT | daily.dev og:description: AI coding agents let engineers spin up internal tools and cloud infrastructure in an afternoon without tickets, reviews, or security involvement, creating a... og:url: https://daily.dev/posts/vibe-coded-apps-are-the-new-shadow-it-ktkyz3ej0 og:image: https://api.daily.dev/og/posts/KTkyZ3EJ0.png og:image:alt: Vibe-coded apps are the new shadow IT og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Vibe-coded apps are the new shadow IT **[The New Stack](https://daily.dev/sources/newstack)** · 8 min read · 0 upvotes · 0 comments ## Summary AI coding agents let engineers spin up internal tools and cloud infrastructure in an afternoon without tickets, reviews, or security involvement, creating a new form of shadow IT that lives inside your cloud account rather than as external SaaS. Unlike SaaS sprawl, this 'code sprawl' has IAM roles, production data access, and no obvious detection seam. The piece proposes a two-layer baseline: platform controls (IAM least-privilege guardrails, secrets manager enforcement, VPN-gated deployment defaults) set once at the org level, and process controls (automated baseline checks, tiered security-informed code review) applied at the point of building. CSPM tools like Wiz act only as a catch layer for what slips through. The piece is sponsored by Webflow and previews an internal Claude-skill-based baseline tool. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What security risks come from letting engineers use AI agents to build and deploy internal tools directly to cloud infrastructure? AI agent-built internal tools can provision cloud resources, open ports, and attach IAM roles without any ticket, review, or security involvement, creating infrastructure that lives inside the cloud account with no detection seam. Common issues include over-permissioned IAM roles, public-facing endpoints, and hardcoded credentials, often undetected until a CSPM scan flags them weeks later. _Security teams tracking AI-driven infrastructure risks can follow emerging guardrail patterns on daily.dev._ ### How can a security team prevent AI-generated infrastructure from becoming an internal risk before deployment? Combine platform controls set once at the org level (IAM least-privilege guardrails, enforced secrets manager usage, VPN-gated deployment defaults) with process controls at the tool level (an automated baseline check against security policy before human review, followed by security-informed code review escalated by risk tier). CSPM tools then act only as a catch layer for anything that slips through. _Teams designing security baselines for AI-assisted development can track these practices on daily.dev._ ### Why doesn't traditional shadow IT detection (OAuth logs, SSO anomalies) catch AI agent-built internal tools? Classic shadow IT detection relies on external signals like OAuth grants and network traffic because unauthorized SaaS tools sit outside company infrastructure. Agent-built tools instead run inside the cloud account with legitimate IAM roles and no deployment pipeline, change ticket, or asset inventory entry, so the detection playbook built for SaaS sprawl does not translate to this code sprawl. _Developers navigating the shift from SaaS to code sprawl can follow related security coverage on daily.dev._ --- Tags: [#security](https://daily.dev/tags/security), [#vibe-coding](https://daily.dev/tags/vibe-coding), [#iam](https://daily.dev/tags/iam) [View this post on daily.dev](https://daily.dev/posts/vibe-coded-apps-are-the-new-shadow-it-ktkyz3ej0) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Vibe-coded apps are the new shadow IT","url":"https://daily.dev/posts/vibe-coded-apps-are-the-new-shadow-it-ktkyz3ej0","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/vibe-coded-apps-are-the-new-shadow-it-ktkyz3ej0"},"datePublished":"2026-09-01T15:01:24.406Z","dateModified":"2026-09-01T15:01:55.635Z","description":"AI coding agents let engineers spin up internal tools and cloud infrastructure in an afternoon without tickets, reviews, or security involvement, creating a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/44d57ab4ecbac0c2e82e0f909651399a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/44d57ab4ecbac0c2e82e0f909651399a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The New Stack","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The New Stack","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/newstack","url":"https://daily.dev/sources/newstack"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/vibe-coded-apps-are-the-new-shadow-it-ktkyz3ej0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,vibe-coding,iam","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The New Stack","item":"https://daily.dev/sources/newstack"},{"@type":"ListItem","position":3,"name":"Vibe-coded apps are the new shadow IT"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/vibe-coded-apps-are-the-new-shadow-it-ktkyz3ej0#faq","mainEntity":[{"@type":"Question","name":"What security risks come from letting engineers use AI agents to build and deploy internal tools directly to cloud infrastructure?","acceptedAnswer":{"@type":"Answer","text":"AI agent-built internal tools can provision cloud resources, open ports, and attach IAM roles without any ticket, review, or security involvement, creating infrastructure that lives inside the cloud account with no detection seam. Common issues include over-permissioned IAM roles, public-facing endpoints, and hardcoded credentials, often undetected until a CSPM scan flags them weeks later. Security teams tracking AI-driven infrastructure risks can follow emerging guardrail patterns on daily.dev."}},{"@type":"Question","name":"How can a security team prevent AI-generated infrastructure from becoming an internal risk before deployment?","acceptedAnswer":{"@type":"Answer","text":"Combine platform controls set once at the org level (IAM least-privilege guardrails, enforced secrets manager usage, VPN-gated deployment defaults) with process controls at the tool level (an automated baseline check against security policy before human review, followed by security-informed code review escalated by risk tier). CSPM tools then act only as a catch layer for anything that slips through. Teams designing security baselines for AI-assisted development can track these practices on daily.dev."}},{"@type":"Question","name":"Why doesn't traditional shadow IT detection (OAuth logs, SSO anomalies) catch AI agent-built internal tools?","acceptedAnswer":{"@type":"Answer","text":"Classic shadow IT detection relies on external signals like OAuth grants and network traffic because unauthorized SaaS tools sit outside company infrastructure. Agent-built tools instead run inside the cloud account with legitimate IAM roles and no deployment pipeline, change ticket, or asset inventory entry, so the detection playbook built for SaaS sprawl does not translate to this code sprawl. Developers navigating the shift from SaaS to code sprawl can follow related security coverage on daily.dev."}}]} ```