AI coding tools must not propagate vulnerabilities, says NCSC head

UK National Cyber Security Centre CEO Richard Horne has called on security professionals at RSA Conference 2026 to harness the explosive growth of AI-assisted software development, known as vibe coding, as a chance to make software more secure, provided safeguards are built in from the start, reports Infosecurity Magazine.

Horne acknowledged that AI-generated code could propagate vulnerabilities if left unchecked, but argued that well-trained tooling writing secure-by-design software could transform cybersecurity outcomes. "

Disrupting the status quo of manually produced software that is consistently vulnerable is a huge opportunity, but not without risk of its own," he said. In a parallel blog post, NCSC CTO David C laid out a series of "commandments" for securing vibe coding, including integrating secure-by-default practices into AI models, adopting a trust-but-verify approach with provable model provenance, using AI to audit all code, and enforcing deterministic guardrails on what code can do.

He argued that AI could help pay down technical debt by hardening legacy applications and that the new paradigm might even offer a path forward for organizations still wary of cloud migration.

Written by

Kelley Damore Chief Content Officer CyberRisk Alliance

Kelley Damore is Chief Content Officer at CyberRisk Alliance, where she leads content strategy across the company’s digital brands, research, communities and live events serving CISOs and security practitioners. At CyberRisk Alliance, she is focused on delivering 365-day engagement, trusted journalism and actionable insights to help security leaders navigate an increasingly complex threat landscape.