AI-written code and secure software development
AI-written code raises questions about review, maintainability, and who understands the implementation when something breaks. This guide is for AppSec engineers and security leaders evaluating generated software beyond whether it runs. AI Security Table, the roundtable podcast with Chris Romeo, Izar Tarandach, and Matt Coles (formerly The Security Table), debates vibe coding, specifications, and human responsibility. These episodes examine the assumptions behind replacing development work with prompts.
Questions we keep arguing about
Can we trust code we did not write?
The hosts question the maintainability and traceability of generated changes. They discuss what reviewers need to know about the context behind that code. Their debate treats a working result as the beginning of evaluation rather than the end. Hear the discussion.
Does a specification remove ambiguity?
The table debates whether written intent can reliably become a correct implementation. They question tests produced by the same AI that writes the code and consider flaws that survive in a specification. Regenerating the implementation would reproduce those flaws unless the underlying intent changes. Hear the discussion.
What remains for humans if source code disappears?
Matt argues that code always matters, while Izar challenges the idea that another abstraction removes ambiguity. The hosts consider giving up pull-request review and generating software on demand. They return to responsibility when no one understands how the implementation works. Hear the discussion.
Episodes
When Code No Longer Matters
The table asks what humans could review if agents generated instructions without readable source code. The debate moves through language evolution, pull requests, and responsibility for failure.
Is Spec-Driven Development Already Dead
Specifications promise a path from written intent to generated software. The hosts debate ambiguity, self-generated tests, and defects that remain in the specification across repeated builds.
Vibe Coding: Can You Put Your Trust in the Machine?
The hosts question how reviewers can trust and maintain AI-generated changes at scale. They discuss context, traceability, and integration into open-source projects.
Vibe Coding: What Could Possibly Go Wrong?
The table examines whether prompt-generated software is ready for production or better suited to prototypes. The hosts debate code quality, security, and preserving human understanding.