VIBE CODED APPS ARE THE NEW SHADOW IT

Summary from the TLDR Design newsletter

AI-generated internal tools now create infrastructure with IAM roles and no ticket, review, or security involvement, unlike traditional SaaS-based shadow IT. A layered defense is proposed: platform controls prevent risky defaults, while process controls require automated baseline checks and security-informed human review before deployment. Cloud security posture management tools and behavioral telemetry signals serve as a detection safety net for tooling that slips through preventive layers undetected.