Executive Summary
A report on 2,000 exposed vibe-coded apps shows employees building and publishing AI-made apps wired into production without security review.
What Happened
Shadow AI used to mean employees pasting things they shouldn't into ChatGPT. It now means something bigger: employees building full applications with AI, wiring them into production systems, and publishing them on the open internet. Without Security or IT in the loop. The artifact moved from a prompt to a product. The risk surface moved with it. In The Shadow Builders report (get it here), a
Vulnerability / Attack Technique
Exposed AI-built applications
Technical Mechanism
Shadow builders publish apps with production access.
AI Security Category
LLM02:2025 Sensitive Information Disclosure
Relevant Frameworks
RealGround Analysis
Shadow AI has moved from prompts to products. RealGround analysis: discover AI-built apps on your domains.
Recommended Controls
- Scan for unreviewed apps on company domains
- Require review before production access
Related RealGround Service
AI Security Readiness Assessment · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/05/what-2000-exposed-vibe-coded-apps.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.