At Telefónica Tech, artificial intelligence (AI) is already part of our day-to-day work, supporting us in the creation of software and new services. It is used for various tasks, such as analyzing requirements, designing solutions, generating code, creating tests, and reviewing implementations.
As AI models have evolved, one idea has gained increasing prominence: the challenge is no longer simply getting AI to generate code. The real challenge is getting it to generate secure code we can trust.
Today, generating software is becoming increasingly easy. Ensuring that this software is correct, maintainable, and secure is a challenge that is becoming increasingly important.
In an environment where every new feature can also become a new attack surface, security must be part of the conversation from the very first prompt.
What are the risks of “Vibe Coding” when AI-generated code seems to work?
One of the most interesting phenomena we’re seeing is the rise of so-called Vibe Coding, a term we’re becoming increasingly familiar with. The developer community continually shares examples of applications, video games, and complete solutions built in just a few hours thanks to the most advanced AI models.
We ask the AI for something, test the result, spot something we don’t like, tweak the prompt, and regenerate. We repeat the process until the solution seems to do what we expect. It’s fast, convenient, and, in many cases, works surprisingly well.
The problem arises when we start evaluating the software solely based on its external behavior. Does the screen display the correct result? Does the API return the expected response? If the answer is yes, we tend to assume that everything is fine. But security is rarely apparent from the interface.
In my experience, I’ve encountered situations where the generated code seemed perfectly valid at first glance and yet required a more in-depth review to identify potential issues: improper concurrency handling, incomplete access controls, accidental exposure of sensitive information, or architectural decisions that were difficult to maintain. The system might have served its purpose, but the implementation was not necessarily secure or maintainable.
For example, during a review of a solution developed with AI support, it was identified that certain information might be unnecessarily recorded in the application logs. Although the functionality behaved as expected, the analysis revealed a potential risk of information exposure that might not have been evident if validation had been limited solely to the functional outcome.
Another review also identified a potential issue in the definition of access controls for certain datasets. These types of situations highlight the importance of specifically reviewing authorization mechanisms, as improper configuration could lead to risks of unauthorized access to information.
How does AI-powered specification-driven development work?
As models become capable of generating more code and more complex solutions, relying solely on iteratively refining the generated results is beginning to prove insufficient.
For this reason, work methodologies designed to incorporate AI at every stage—such as specification-driven development—are becoming increasingly important.
In our experience, tools such as Spec Kit, the AI-Powered Specification-Driven Development Toolkit, can facilitate this specification-driven development approach. The starting point is usually a user story or a requirement defined in Jira by the specification team.
From there, AI can help refine ambiguous requirements, identify inconsistencies and edge cases, analyze design decisions, and build a more comprehensive specification. Only then does implementation follow.
The better a requirement is understood before code is generated, the less we rely on the model to correctly interpret our intentions. AI ceases to act solely as a code generator and begins to behave as an engineering assistant.
What risks does AI-powered code generation pose?
The models currently used to develop software have evolved and incorporate various mechanisms aimed at reducing certain errors and unintended outcomes. These protection, validation, and alignment mechanisms—commonly known as guardrails—seek to minimize issues such as the recommendation of made-up APIs, code snippets that fail to compile, or nonexistent dependencies.
However, these mechanisms do not eliminate the need to validate the generated code, nor do they eliminate certain risks. Hallucinations still occur, including phenomena such as package hallucinations, in which AI may recommend nonexistent, incorrect, or, in some cases, dangerous dependencies.
In addition to these technical risks, there is another aspect that does not always receive the same attention: the use of AI tools that have not been previously evaluated and authorized by the organization. Using models or assistants without the proper safeguards can introduce risks related to the protection of corporate information, the accidental exposure of sensitive data, or the generation of code without the quality and security controls required by the company.
Therefore, just as important as choosing which model to use is ensuring that it is part of the organization’s governed and approved ecosystem of tools.
But above all, more subtle and difficult-to-detect risks have emerged: architectures that appear correct but are poorly designed; incomplete access controls; potential information leaks; the absence of critical validations; non-compliance with internal standards; or technical decisions that compromise the system’s future maintainability.
Added to this is a risk that is perhaps even more concerning: excessive trust in AI. The better the result it generates, the greater the temptation to accept it without question. The current challenge is no longer just to detect when AI makes a mistake, but also to avoid assuming that it does not.
If the risks are becoming increasingly difficult to detect through a simple visual inspection of the result, we need mechanisms capable of objectively and continuously verifying that what the AI generates meets the functional, architectural, and security requirements defined for the solution.
Why might manual review of AI-generated code not be enough?
There is one recommendation that comes up constantly when discussing AI-assisted development: manually review the generated code. This recommendation, which has been essential until now, may begin to fall short and, in some cases, prove difficult to implement as the sole control mechanism.
The capacity for code generation is growing faster than our ability to review it. As the amount of automatically generated code increases, human review remains essential, but it may not be sufficient or feasible on its own.
That is why we need automated mechanisms capable of scaling at the same pace as code generation. And it is precisely at this point that automated testing becomes one of our primary mechanisms for validation and assurance.
Unit tests take on a particularly important role because they allow us to precisely define what it means for a feature to be correct. In fact, using tests as part of the specification itself is becoming increasingly valuable. In many cases, these tests can also be generated with the help of AI.
On the one hand, they serve as a contract for the specification, since they allow us to verify that the code complies with the defined requirements on a unit-by-unit basis. Furthermore, AI can be particularly useful in supporting the generation of unit tests, precisely because a specification and a test share much of the same information.
Essentially, the test expresses in an executable form what had previously been defined as expected behavior.
On the other hand, tests also serve as a guide for the AI to validate the code it generates and apply the necessary corrections iteratively. When we work this way, there is an objective definition of success.
But beyond unit tests, there is a particularly interesting impact on the automatic validation of the entire system. Traditionally, end-to-end tests have been costly to design, automate, and maintain. In our experience, AI can facilitate the construction of test environments, the generation of scenarios, and the execution of validations.
Thanks to this type of testing, it’s possible to deploy complete modules of a solution within local sandbox environments and subject them to different scenarios. This allows us to validate complex behaviors, test exceptional situations, reduce risks before deployment, and minimize the need to use production environments for certain validations.
How can AI be used to review code generated by another AI?
Although it may seem paradoxical, if we use AI to generate code, we can also use it to help review it.
In our experience, GitHub Copilot Code Review can be used as an additional tool to review code before it is integrated into the repository, always as a complement to the analysis performed by developers.
This type of review can help identify potential errors, unanticipated edge cases, maintainability issues, possible security risks, and inconsistencies with the rest of the solution.
The goal of this review is by no means to replace the work of developers, but rather to provide an additional analytical capability that complements human review.
Cybersecurity can also be integrated into this type of automated review. The true value emerges when these capabilities are enriched with specific knowledge and recognized security criteria.
For example, this type of review can incorporate criteria and best practices based on references such as the OWASP Top 10.
In this way, the knowledge accumulated by an organization in the field of cybersecurity can be incorporated more systematically into the review process, without relying exclusively on the experience or individual judgment of each developer.
AI can not only help review aspects related to code quality but also help enforce best practices and security controls, increasing the likelihood of identifying potential risks before they reach production.
This ensures that AI-assisted code review is not limited to analyzing overall code quality. It can also help identify risks related to injection, access control, secret management, insecure configurations, exposure of sensitive information, or vulnerable dependencies.
Each new contribution to the repository can be analyzed with this specialized knowledge in mind—not only in the context of the new code but also considering the project as a whole.
Will artificial intelligence replace software developers?
Sometimes the debate is framed as if AI were going to replace developers. My experience has been exactly the opposite. The more advanced these tools become, the more important it is to apply sound engineering principles.
The difference is that AI can now assist us at every stage of the software development lifecycle: defining requirements, refining specifications, reviewing designs, generating code, creating tests, flagging potential vulnerabilities, and reviewing changes.
Automatic code generation is just one piece of the puzzle. A significant part of this transformation may lie in having autonomous agents capable of supporting us during different stages of the software development process.
Because the future probably doesn’t belong to uncontrolled Vibe Coding. It will belong to teams capable of combining the capabilities of artificial intelligence with the discipline of software engineering.
Ultimately, the evolution of AI does not eliminate the need to apply best practices in engineering and cybersecurity. On the contrary: the more capable the models are, the more important it is to have clear specifications, automated validation mechanisms, and robust review processes.
The future of development will not be a matter of choosing between developers and artificial intelligence, but of learning to intelligently combine the strengths of both.
The security of AI-generated software does not begin when we review the code. It begins much earlier: when we define the specification, select the appropriate tools, and establish the validation mechanisms our organization will use.
AI can generate large amounts of code quickly. The responsibility for deciding whether we can trust that code will remain with humans.
Secure software development with artificial intelligence exemplifies a broader challenge: making increasingly advanced digital technologies accessible without compromising innovation, trust, quality, and accountability.
In this context, Telefónica is working to further strengthen its role as one of the main gateways for people to access digital technologies. The responsible integration of AI into technological processes is part of this transformation, in which innovation also requires enhancing engineering, validation, and security mechanisms.
Frequently Asked Questions
What is Vibe Coding?
Vibe Coding describes a method of creating software through iterative interaction with AI models: a solution is requested, the result is tested, the prompt is modified, and the process is repeated until the expected behavior is achieved.
What are the risks associated with AI-generated code?
The code may appear to function correctly but could still contain concurrency issues, faulty access controls, exposure of sensitive information, problematic dependencies, missing validations, insecure configurations, or maintenance difficulties.
What are “package hallucinations”?
These are situations in which an AI system recommends dependencies that are nonexistent, incorrect, or, in certain cases, dangerous.
Why are specifications important before generating code with AI?
A properly specified requirement reduces reliance on the model to interpret the team’s intentions on its own and allows AI to be used as an assistant during a defined engineering process.
What role do automated tests play in AI-driven development?
Tests allow the expected behavior to be expressed in an executable form and provide objective criteria for verifying that the code meets the specification. Additionally, they can serve as a guide for iterative generation and correction processes.
Can artificial intelligence be used to review code created with AI?
Yes. AI-assisted code review tools can be used to analyze code intended for inclusion in a repository, as a complement to the review performed by developers.
Does AI replace human code review?
Not in the proposed approach. Automated review adds analytical capabilities, while developer review remains an essential part of the process.
