By Asha Geire (originally published under The Traveling Privacy Lawyer blog on Substack on June 22, 2026)
This week I’m simultaneously reading The Black Box Society by Frank Pasquale and The Uninhabitable Earth by David Wallace-Wells. I’m normally an optimistic person, but I’m presently oscillating between imagining a future where politicians cater to tech billionaires AND a future where the survival of mankind itself is uncertain.
I don’t want to depress you, so instead, I will flag some legal liabilities associated with vibe coding.
In case you are living under a rock: vibe coding is the practice of using AI to generate software from natural language prompts with limited human review. I’ve recently met several people who claim they are building products via LLMs and deploying them inside their companies, on personal systems, or selling these products/services to others. Some have no programming background at all. Others have some training but prefer the speed of AI.
Please be aware that use of an artificial intelligence tool to generate code does not mean you share liability with the AI provider. AI code generation systems almost always include clauses in their terms and conditions stating the output may have errors and should not be relied on. It is therefore up to developers and those deploying the code/software to carry out the necessary tests, security audits, and code reviews before putting anything into production.
The security risks aren’t hypothetical. I recently read that Veracode tested over 100 large language models on security-sensitive coding tasks and found that 45% of AI-generated code samples introduce OWASP Top 10 vulnerabilities! The same article noted Georgia Tech’s Vibe Security Radar project tracked 35 CVEs in a single month (March 2026) directly attributable to AI coding tools, with researchers estimating the true count is five to ten times higher across the broader open-source ecosystem.
Another article flagged that in February 2026, Moltbook, a social networking site built entirely through vibe coding, misconfigured its Supabase database and left it with public read and write access, exposing 1.5 million authentication tokens and 35,000 email addresses. It turned out the AI scaffolded the database with permissive settings during development, and the founder ( who likely didn’t have the skills needed to review the infrastructure code ) deployed it as-is.
So, if you’re vibe coding and deploying to users and/or selling your services/products, at minimum, follow the current NIST AI Risk Management Framework, and document your attempts to discover vulnerabilities through red-teaming and testing. Also, consider using something like the Software Development Life Cycle framework to capture your human inputs and reviews. Some state laws, including Texas’s TRAIGA, offer a compliance safe harbor for exactly these documented efforts.
Beyond compliance issues, you should be aware that your clients may sue you for negligence —this requires showing a duty of care, breach, causation, and damages. Anyone marketing a working application or an agentic AI that automates consequential tasks will be held to the standard of skill generally applicable in the industry. If you have no programming background, rely on AI to both write and audit your code, and something goes wrong — you are likely in breach of your duty of care. The “the AI built it” defense does not exist. Some state laws, like California AB 316, explicitly preempt this type of defense.
**Disclaimer: This newsletter is for informational purposes only. It is not legal advice, and reading it does not create an attorney-client relationship. Consult a qualified attorney before making decisions based on anything published here.**