Tagged “risks”
3 posts.
What AI slop is, and how to keep it out of your code
AI slop is low-quality digital content produced in volume by AI that reads as fluent and competent while carrying little substance. In a codebase it takes a specific and more awkward form: code that compiles, passes the obvious tests and satisfies the wording of your prompt, while ignoring the structure, conventions and constraints the rest of the system depends on. It is not broken code, because broken code gets caught. It is plausible code in the wrong place, in quantity, and the cost of it arrives months after the commit. Keeping it out is a matter of narrowing what you ask for, writing down the conventions the model cannot infer, running deterministic checks that look for the specific shapes slop takes, and keeping a human on the architecture.
Security risks of vibe-coded apps and how to fix them
Vibe-coded apps break most often on access control, exposed secrets and baseline defences nobody asked for in the prompt. Veracode's testing of more than 100 models found 45% of security-sensitive samples introduced an OWASP Top 10 vulnerability, and Carnegie Mellon researchers found that while 61% of AI-generated code functions correctly, only 10.5% passes security review. Reducing that exposure does not require rewriting everything by hand. It requires controls outside the model: separated environments, default-deny data access, secrets kept out of source, scanning in the pipeline, and a human reading the diff wherever trust boundaries live.
Why AI coding tools invent APIs that do not exist
AI coding tools invent APIs because they predict likely next tokens rather than looking anything up in a real library. There is no step in which the model checks whether a function, parameter or package name exists; it produces text that fits the pattern of the surrounding code, and a name that fits the pattern is not the same as a name that resolves. That is why the output is plausible rather than random, and why the failure is easy to miss on a read-through and trivial to catch by running the code, resolving the dependency, or checking the documentation for the exact version you are using.