The NCSC Says Different Code Deserves Different Levels of Oversight in AI-Assisted Software Development

The UK's National Cyber Security Centre published a blog post on June 18, 2026, headed "The 'vibe coding spectrum' approach to AI-assisted software development." It describes vibe coding as "giving an AI agent a high-level prompt and letting it build your application with significant autonomy." Its subheading says that different code "deserves different levels of oversight," and that the approach to vibe coding should be calibrated accordingly. Parts of the post follow, not the whole.

Where the Risk Lies

AI models are trained on vast amounts of existing code, the post says, and some of that code has security issues. "When you let an AI loose on your code base with minimal oversight, there's a real risk it produces code with security vulnerabilities." It adds a second issue: the code base could become complicated and confusing to understand, which could lead to further issues with maintainability.

Does that mean vibe coding should not be used? "Not necessarily," the post says. "It depends on what you're building." A proof of concept to demonstrate an idea is low risk, and an internal tool with limited risk may be manageable. Authentication logic for a public facing website, code that processes sensitive customer data, anything handling secret tokens or credentials, and safety critical code in critical national infrastructure or code responsible for flying an aircraft are, in its words, "a different story." "The risk isn't in using AI. The risk is not applying the right safeguards when the stakes are high."

A Spectrum, Not a Switch

"Vibe coding isn't binary," the post says. On the left of its spectrum is manual coding with some AI assistance, such as autocomplete that a developer accepts or not. On the right is full vibe coding, where the AI "has autonomy over architecture, code, modules, and tests" and the developer is "not editing or deeply reviewing the code." In between is a large gray area. One example it gives is writing tests manually and letting the AI implement code until those tests pass.

Oversight, and Choosing a Position

The post does not tell anyone to keep AI away from security-critical code. "AI can absolutely help you to write authentication logic, data processing pipelines and check your homework," it says. For the authentication system that protects customers' accounts, though, it says a developer needs more rigor: to review what the AI produces, understand the code, check for vulnerabilities, and verify that it does what is expected. Another AI agent could even help with those oversight activities. The wider system also needs to be designed to minimize the impact of exploitation.

The NCSC "recommend that you think carefully about what you're building, understand the risk, and then slide along the spectrum accordingly." The post suggests sliding toward manual coding for authentication or authorization logic, sensitive personal data, secrets, tokens or credentials, anything safety critical, and wherever "the consequences of a security flaw would be significant."

It ends on what may change. AI models are improving rapidly, the post says, and the spectrum might shift. "But we're not there yet. Calibrate your approach based on today's reality, not tomorrow's potential."