Vibe Coding 2.0: A Whole Company Codes With AI, So Who Keeps Control

Vibe Coding 2.0: A Whole Company Codes With AI, So Who Keeps Control

A year ago, vibe coding (talking to an AI so it writes code for you, no programming background needed) was still a solo hobby, one person building a small app for fun. Now entire companies want to do the same thing: dozens of teams building hundreds of internal apps every week. The real question is, who controls those apps, and who is responsible when they touch real customer data?

That is the theme of a recent video from the Wes Roth channel, where he uses the platform Superblocks to build a customer support CRM from scratch, then asks: when a whole team, not just one person, vibe codes together, what needs to change about permissions, security checks, and whether the company can still keep track of its own systems.

The real problem: anyone can build an app, but IT sees nothing

According to Superblocks itself, enterprise vibe coding is turning into a new kind of shadow IT. Business teams build applications directly on top of real production data, while the IT department has almost no visibility into which apps exist, who created them, or what data they touch. When one person builds a toy app on their own, the risk is small. But when dozens of non-technical employees build hundreds of apps a week, a badly written piece of AI code, a leaked secret key, or a wrongly granted permission can all cause real damage.

The fix: let AI code, but the company still sets the rules

Instead of banning employees from using AI to code, which is hard to enforce anyway, Superblocks 2.0 and 3.0 keep the speed of vibe coding while adding an IT control layer behind it:

• The AI only does what it is allowed to do. Superblocks' AI assistant, Clark, does not generate queries or actions beyond what that specific user is already permitted to access, much like a new employee who only has keys to the doors they are supposed to open.
• Every action is logged. Who created which app, what they changed, and what data they touched is all recorded for later review, instead of disappearing into a black box.
• Data and AI stay inside the company's own environment. With private cloud deployment (AWS, Azure, GCP), company data is never sent out to external services, and still follows the security and encryption rules the company already has in place.
• A virtual security team reviews code before it goes live. A swarm of AI agents automatically scans every code change for common issues like leaked secrets or SQL injection before an app is allowed into production.
• Open source libraries are controlled too. Instead of letting AI pull in any public package, the system only connects to an approved internal package registry, reducing the risk of malicious code sneaking in.

One concrete example cited is Virgin Voyages, where non-technical teams built multiple internal applications now running live across several departments, without a dedicated front end engineering team, while IT still kept full visibility and control.

What this means for you

If you are still vibe coding on your own, this story does not change much for you directly. But it shows where the industry is heading: vibe coding is no longer just a clever personal trick, it is becoming how companies actually operate, and the hardest part is not getting AI to write code, it is controlling who gets to do what with that code.

If your company is considering letting employees build internal apps with AI, three questions worth asking first are: who can see the AI's action logs, does the data it processes ever leave the company's own systems, and who reviews the code before it touches real data. This is also why more large companies are choosing to build whole teams of coordinated AI agents instead of letting people chat with AI in isolation, and why checking permissions before letting AI edit live code is becoming a required step rather than an optional one.

If this is the first time you are hearing the term, our foundation guide on what vibe coding is explains the basics before you dive into the enterprise side. And if you are curious how far one individual developer can push this approach, the story of one developer who vibe coded a free alternative to the entire Adobe suite using Claude Opus 5.5 is a striking example.

Limits worth knowing

These figures and features come from Superblocks' own announcements, not an independent third party review. A tool having a permission control layer does not mean it is immune to mistakes. Employees still need training on the fact that AI can write incorrect code or misunderstand a request, and companies still need a human review step before any important application goes into real use.

#VibeCoding #EnterpriseAI #AISecurity #AIAgent #AINews