OWASP Top 10 2025: Vibe Coding and Supply Chain Risks
Tanya Janka, project leader for the OWASP Top 10 2025, discusses the inclusion of vibe coding as a critical risk. The analysis covers the shift from vulnerability memorization to secure coding habits, the expansion of supply chain threats to include human developers, and actionable strategies for engineering leaders to integrate security into AI-assisted workflows.
The Paradigm Shift in Application Security
The 2025 OWASP Top 10 marks a pivotal departure from traditional risk categorization by explicitly including "vibe coding" and expanding the software supply chain scope. Tanya Janka, project leader for the initiative, highlights that the threat landscape has evolved beyond static vulnerabilities to include dynamic, AI-driven risks. The inclusion of vibe coding signals that the industry can no longer ignore the security implications of unreviewed, AI-generated code, which now constitutes a significant portion of new software development.
The Human Element in Supply Chain Attacks
A critical insight from the analysis is the redefinition of supply chain risk. While traditional models focus on malicious dependencies, current breach data indicates that compromising a single developer is often the primary vector for major incidents. This shifts the security perimeter to include the human engineer, requiring organizations to protect not just code repositories, but also developer workstations, credentials, and physical safety. The asymmetry between defenders and attackers is exacerbated by the speed at which AI agents can exploit these human-centric vulnerabilities.
Strategic Imperatives for Engineering Leaders
Engineering leaders must pivot from a "boogeyman" approach to security, which relies on fear and memorization, to a practice-based model focused on secure coding habits. The data suggests that post-hoc static analysis is insufficient for AI-assisted development, leading to overwhelming backlogs and developer burnout. Instead, security must be shifted left into the code generation process. By embedding security prompts and controls directly into AI workflows, organizations can reduce the cost of rework and improve the baseline security of generated code.
Actionable Frameworks for Implementation
Immediate actions include disabling post-install scripts in package managers to mitigate NPM ecosystem risks and implementing strict review protocols for AI-generated code. Furthermore, organizations should adopt behavioral economic principles to align developer incentives with security goals, ensuring that the secure path is the easiest path. By focusing on pattern recognition for fundamental controls like input validation, teams can build a resilient security culture that scales with the velocity of modern software delivery.
Key insights
-
The OWASP Top 10 2025 includes vibe coding, recognizing that unreviewed AI-generated code is a distinct and critical risk category. This reflects a broader industry acknowledgment that AI acceleration outpaces traditional security review processes.
Impact: Forces organizations to redefine code review policies to specifically address AI-generated artifacts, preventing the normalization of unvetted code in production environments.
-
Supply chain attacks increasingly target individual developers rather than just software dependencies. A compromised developer with high access can break multiple parts of the chain, making the human a primary attack surface.
Impact: Requires a holistic security strategy that includes physical, digital, and social engineering protections for engineering staff, not just technical dependency scanning.
-
Post-hoc static analysis is ineffective for AI-assisted development, creating unmanageable backlogs of vulnerabilities. Security must be integrated into the code generation phase to be viable at current development speeds.
Impact: Reduces the cost of security remediation and improves developer productivity by preventing vulnerabilities from entering the codebase in the first place.
-
Training developers to memorize vulnerabilities is less effective than teaching them to recognize secure coding patterns. Pattern recognition for basic controls like input validation builds durable security habits.
Impact: Creates a more resilient security culture where developers can identify and fix issues independently, reducing reliance on specialized security teams.
-
Perverse incentives often prioritize feature release speed over security, leading to shadow IT and bypassed controls. Aligning incentives and making secure defaults the easy path is crucial for adoption.
Impact: Improves security compliance and reduces the risk of shadow AI and unvetted tools by making secure practices the path of least resistance for developers.
Action items
-
Implement a mandatory human review protocol for all AI-generated code, treating it as untrusted input. Use specific security prompts to guide AI output but do not rely on them as a substitute for review.
Impact: Mitigates the specific risks associated with vibe coding, such as hidden secrets or removed error handling, ensuring that AI acceleration does not compromise code integrity.
-
Disable post-install scripts for all package managers organization-wide by default. Require explicit trust verification and review for any package that attempts to execute code during installation.
Impact: Significantly reduces the attack surface from malicious NPM packages and supply chain attacks, preventing automatic execution of untrusted code in developer environments.
-
Shift security controls left by embedding security requirements and prompts directly into the AI code generation workflow. Integrate secure coding guidelines into the system prompts used by AI assistants.
Impact: Improves the baseline security of generated code and reduces the volume of critical vulnerabilities that need to be addressed in post-hoc static analysis, lowering remediation costs.
-
Revise developer training programs to focus on pattern recognition for basic security controls, such as input validation and error handling, rather than memorizing specific CVEs or vulnerability lists.
Impact: Builds a more effective and sustainable security culture where developers can proactively identify and fix common security issues, reducing the burden on specialized security teams.
-
Audit and realign organizational incentives to reward secure coding practices, not just feature delivery speed. Make the secure path the default and easiest option through tooling and process design.
Impact: Reduces the prevalence of shadow IT and security bypasses by aligning developer motivations with organizational security goals, leading to higher compliance and lower risk.
Quotes
“Vibe coding is the AI is writing everything. You have no time to review it or you're not taking the time to review it and you're just committing what the AI says.”
“I actually have a slightly different opinion that kind of goes one layer up from that. And if you look at some of the things that they call a supply chain attack, What actually happened for some of the biggest ones is it was actually one software developer employee, one human being that was compromised.”
“If you can be more reasonable and just look at, like, this is legitimate business risk or this isn't. Like the hardest part was just learning how to communicate clearly.”