Earlier this year, the CEO of a coffee chain with well over a hundred locations posted on LinkedIn that software would soon be free. The real value, he said, would sit in the data and services around it. He’d started “vibe coding” every evening and weekend six weeks earlier, and the following Monday he told the 15 people reporting directly to him to use an AI tool.
(Vibe coding simply means describing the software you want to an AI tool in plain English and letting it write the code for you. No programming skills needed.)
In October, a technology news site reported that an internal dashboard at the company was handing data to anyone who knew where to look.
The dashboard had a login screen, so it looked protected. But behind the scenes, the page sent a large amount of data to your browser before you’d even logged in. Anyone with the web address could read it. The news site confirmed it included names and contact details for 132 locations, along with some performance and financial data.
How it was found is the part that should make any business owner wince. Employees had posted photos of their laptop screens on Instagram, and the web address was visible in the background.
The app was taken down after journalists made enquiries. Neither the CEO nor the company responded to requests for comment before publication.
To be fair, nobody set out to leak anything, and the AI tool wasn’t really the problem. Nobody checked what the app was giving away before anyone logged in. That gap is where vibe coding security risks come from, and it’s about to get wider.
Why is Everyone Suddenly Building Free Software?
In early October 2026, a wave of free Adobe alternatives appeared on GitHub (a website where developers share code), including PhotoCraft, a Photoshop lookalike, and LightCraft, a Lightroom lookalike. They were largely written by AI tools rather than a large team of engineers.
The developer behind them says he rebuilt seven of Adobe’s flagship applications from scratch and released them for anyone to use, free of charge. He doesn’t like the “vibe coder” label, and describes himself as a 15-year industry veteran with a decade of experience in the programming language he used.
Then he turned to Microsoft. The same developer has now built free lookalikes of Word, Excel and PowerPoint, called WordCraft, GridCraft and DeckCraft.
The bigger shift here is speed. Software used to be protected by how hard it was to copy. Now AI has made copying so much cheaper that anything a software company builds can, in principle, be recreated and given away far faster than before.
The clones themselves aren’t ready to replace anything yet. One technical write-up describes the Adobe versions as early test builds with hundreds of open bugs and attractive screenshots. Another developer who tracked dozens of these attempts reports that they slow to a crawl on very large images, and that opening other people’s files and getting colours right are both weak spots.
So Adobe and Microsoft aren’t in immediate danger. What matters for your business is what this trend produces: a lot of new software, written very quickly, that almost nobody has properly checked, and that introduces vibe coding security risks.
Why Vibe Coding Security Risks Matter
Most of this new software is built by instructing AI rather than writing code by hand. That’s fine for a weekend project. It’s a different matter once the software touches client or company data.
The research isn’t conclusive, but it points the same way:
- Veracode tested over 100 AI models on 80 coding tasks. 45% of the code they produced failed basic security tests based on the industry’s standard list of common weaknesses.
- Tenzai built 15 apps using five major AI coding tools and found 69 vulnerabilities. None of the apps had protection against a common type of web trickery, and none had the standard security settings you’d expect on a website.
- Moltbook, a social platform that went viral in early 2026, stored its data in an online database but never set the rules for who was allowed to see it. It’s the same type of failure as the coffee chain’s dashboard: it worked, it looked finished, and the locks were missing.
- An academic study collected 9,041 real vibe-coded applications and confirmed 1,186 security flaws across 200 of them. The usual culprits were unfinished placeholder code, no checks on what users typed in, and passwords or keys left exposed.
- CovertLabs scanned 198 AI apps for iPhones and found that 196 had security settings wrong in ways that exposed sensitive data.
One finding stands out for businesses. In one survey, over 75% of developers believed AI-written code was more secure than code written by humans. Yet 56% of the same group admitted that it creates security problems. People trust it more than their own experience says they should.
There’s a fair caveat. The academic team points out that flaws in AI-written code don’t automatically mean AI-assisted development is less safe, because a careful person reviewing the work can catch and fix problems. Better AI models help, but they don’t remove the risk. What matters is whether anyone actually does the reviewing.
A brand-new free app from a single developer usually has no security team behind it. Neither does a dashboard thrown together over a weekend.
“Software Will Be Free” is Half True
The CEO in our opening story has a point. Building software is cheaper than it used to be, and being locked into one vendor is a real frustration. Nobody enjoys renewal time.
What hasn’t gotten cheaper is checking software for vibe coding security risks. Writing an app is now fast. Knowing what it sends out, who can get into it, and what happens when it breaks is still slow, skilled work, and nobody will do it unless you’ve arranged for someone to.
That’s what you’re really paying for with Microsoft 365. It isn’t just Word. It’s everything wrapped around it: sign-in protection, two-step verification, tools to manage staff devices, records of who did what, security fixes on a known schedule, a clear published position on how your data is handled, and a company with legal obligations under UK GDPR.
A free lookalike gives you none of that. If a weakness turns up next month, who fixes it? Who even tells you?
There’s a fair distinction to make here. Established free tools like LibreOffice have years of scrutiny behind them, a track record, and an active community of people maintaining them. That’s very different from a brand-new free alternative that hasn’t earned anyone’s trust yet. “Free and open to the public” and “only a week old” are not the same thing.
For many firms, the cost of getting this wrong isn’t a slow spreadsheet. It’s client data sitting in software nobody has vetted. UK GDPR expects you to keep personal data secure, and if a breach is serious enough, you have to report it to the ICO within 72 hours.
If you’re regulated by a body such as the SRA, ICAEW or FCA, “we installed it because it was free” is a hard sentence to say out loud. And if you hold, or are working towards, Cyber Essentials, unapproved software cuts directly across the promises you’ve made.
It’s a Good Time to Be a Developer
None of this is anti-AI. For developers and anyone building internal tools, this is a great moment. Prototyping has never been faster or cheaper.
The danger is what happens next. A quick experiment becomes something the business depends on, and nobody goes back to check it. That’s where most vibe coding security risks begin.
Six questions to ask before anything new goes live
- Who maintains this, and can you name them?
- How long has it existed, and how often does it get security updates?
- Where do your files and passwords go when you use it?
- Has anyone looked at it from the outside, the way a stranger with the web address would, before anyone logs in?
- Can your IT team see it, manage it and remove it if needed?
- If it breaks or leaks data, who is answerable to your clients?
If a tool can’t answer all six, treat it as a personal experiment, not a business application.
And a small habit worth adding: ask your staff not to post photos of their screens on social media. It’s how the dashboard’s web address got out.
Want a second pair of eyes?
Our Free IT Health Check walks through what’s installed across your business, who can add software, and whether your licensing matches how you actually work.
Call: 01707 378455
Email: hello@tristartechsolutions.co.uk
Frequently Asked Questions
Are vibe-coded apps always insecure? No. Good developers use AI tools carefully and review the output. The risk is highest when software is generated and shipped with little or no review.
Can our team build internal tools with AI? Yes, and many will. Treat what they build like any other business system: someone reviews it, someone owns it, and it gets tested before real data goes near it. A login screen alone isn’t protection.
Is open-source software safe for business? It can be, and many established tools are. Look at maturity, maintenance history and whether security fixes are published, rather than whether the code is public.
Can we use these free alternatives for non-sensitive work? Possibly, but “non-sensitive” tends to shrink over time. It’s safer to agree a rule on what may be installed than to police individual cases.
How do we stop staff installing unapproved software? Restrict who has local admin rights and use an approved-application list managed centrally. It’s an everyday control, not an exotic one.
What if we want to reduce our Microsoft licensing costs? There’s usually room to do it safely: right-sizing licences, removing unused ones, and reviewing which plan each person needs. That’s a better saving than replacing the platform.
