The UK Government Just Called Vibe Coding Security Risks 'Intolerable'

The head of the UK's National Cyber Security Centre (NCSC) stood up at RSA Conference last week and called the security risks from AI-generated code "intolerable." The same week, Cursor's CEO warned that vibe coding builds "shaky foundations" that eventually "crumble." The same week, someone compromised LiteLLM's PyPI package and got 47,000 poisoned downloads in 46 minutes. These aren't separate stories. They're the same story. What the NCSC actually said The NCSC CEO called for international cooperation on vibe coding security. Not guidelines. Not best practices. International cooperation. That's the language governments use when they think a problem is bigger than any one country can solve. Why? Because vibe-coded apps are shipping to production at a rate that outpaces any security review process. The code compiles. The tests pass. The app works. The security is broken. What "broken security" actually looks like We've been scanning vibe-coded apps for months. The pattern is the same