AI-Generated Apps Pose Major Security Risks to Businesses
Translated & summarized from Bizportal by baba
Businesses face new security threats from AI-generated applications, known as "vibe coding," which are often built without IT oversight. A review found over 5,000 apps with weak security, nearly 2,000 containing sensitive data. Further research revealed security vulnerabilities in 91% of AI-generated apps, highlighting risks like improper permission management. Organizations must now map these apps, enforce strict access controls, and conduct security testing to mitigate potential data breaches and associated costs.
The story in 5 lines · by baba
- Over 5,000 AI-generated applications have weak or missing security protections, with nearly 2,000 exposing sensitive data.
- "Vibe coding" allows employees to build apps using AI, often bypassing IT security and connecting to company data.
- A study found security vulnerabilities in 91% of 200 examined AI-generated applications.
- Risks include unauthorized access to customer data, financial records, and business plans.
- Organizations need to map apps, enforce access controls, and conduct security testing for AI-generated code.
The rise of "vibe coding," where employees use AI to build applications by describing their needs in natural language, is creating significant new security risks for businesses. While these tools, offered by platforms like LlamaBuild, Base44, and Replit, allow for rapid development of internal tools like customer management systems or data processing applications, they often bypass traditional IT security oversight. A recent analysis of approximately 380,000 digital assets uncovered over 5,000 applications with inadequate or weak access controls. Alarmingly, nearly 2,000 of these applications contained what appeared to be sensitive private or business information.
These AI-generated applications can connect directly to a company's sensitive data, such as customer databases. A sales manager, for instance, might create a system to view customer data, but misconfigured permissions could inadvertently expose this information to external parties. An Israeli cybersecurity firm, Radware, identified applications that seemingly contained medical data, client communications, business plans, and financial records. While some of these findings were verified journalistically, others remained uncertain, though some application owners confirmed data was exposed and took steps to restrict access.
Further academic research supports these concerns. A study updated in September examined 200 AI-generated applications, finding at least one security vulnerability in 91% of them, totaling 1,186 identified weaknesses. Common issues included poor permission management, inadequate user authentication, and susceptibility to malicious data input. The AI can create functional systems even with incomplete security, such as requiring a login but still allowing access to other users' records, or storing external service access keys within browser-accessible code.
The shift to AI-driven development changes the nature of cyber risk. Previously, new systems underwent vendor vetting and IT approval. Now, employees can deploy systems using personal accounts, linking them to company data on the same day. This poses a risk when employees leave, as their applications may continue to access sensitive data. Addressing this requires organizations to map all applications and their data connections, implement uniform authentication and role-based permissions, document data access, and conduct security testing before deployment. Cybersecurity firms are developing solutions to secure AI-generated code, ensuring that access controls are enforced at the database level and that changes requiring data downloads or external system connections undergo security review, even for AI-created code.