NCSC’s CEO urges development of safeguards around vibe coding

Speaking at the RSAC Conference in San Francisco, Horne duly highlighted how digital societies face a “fundamental issue with the quality of technology we use” due to exploitable vulnerabilities. He spoke of both the opportunity and challenges involved with AI-generated code.

While insecure software produced without human review could potentially propagate vulnerabilities, Horne observed that well-trained AI tooling writing software, which is more secure by design and throughout its lifecycle, could transform cyber security outcomes much for the better.

In the keynote address, Horne stated: “The attractions of vibe coding are clear. Disrupting the status quo of manually produced software that’s consistently vulnerable is a huge opportunity, but not without risk of its own. The AI tools we use to develop code must be designed and trained from the outset so that they don’t introduce or propagate unintended vulnerabilities.”

Horne noted that security professionals had “both the opportunity and responsibility” to ensure that a future where vibe coding and other AI code-generation tools are more widely adopted is “a net positive” for security.

Blog post

The NCSC – which is a part of the UK signals intelligence agency GCHQ – has published a new blog post arguing that code produced by AI currently poses intolerable risks for many organisations, but that vibe coding shows “glimpses of a new paradigm”.

The organisation predicts the business benefits of using AI to write code will drive up adoption. On that basis, it’s vital for security professionals to start engaging with the risks now in order to embed core security principles that will make software less vulnerable to attack.

In his speech, Horne also spoke of how cyber risk is now of “greater consequence than ever before” as we face more exposure, inherent vulnerability and threat activity carried out by “a web of actors who blur the categories, increasingly linking to and enabling each other”.

In order to combat this “multi-dimensional” threat, Horne said that the collective approach for defending our societies must match that, likening cyber defence to a full court press in basketball whereby “collective pressure from all actions together” can have greatest impact.