The Real Talk:
- Why the AI security risk everyone’s worried about (models stealing your data) probably isn’t the one that should keep you up at night
- How “vibe coding” turned every employee into a developer overnight, and why that’s a governance problem wearing a productivity costume
- The counterintuitive fix for stalled AI projects: stop trying to solve five problems at once
A Closer Look:
The MCP Nobody Vetted Loren Horsager of Model Mind AI shared a story that should make every IT leader pause. When MCPs (the connectors that let AI tools talk to your business software) started showing up for QuickBooks, the first result in a Google search wasn’t Intuit’s official version. It was a server built by an independent developer, and it worked. Every bit of QuickBooks data ran through his infrastructure first. Nothing nefarious happened, as far as anyone knows. But nobody who used it actually knew where their financial data was going. That’s the risk hiding in plain sight while everyone’s busy worrying about AI model training.
Vibe Coding Meets Shadow IT Loren’s team increasingly hears the same story from clients: someone builds a working internal tool in a weekend, no developer required, just a clear description of the problem. That’s genuinely useful. It’s also how shadow IT multiplies fast. One example from the episode: a services company stuck in an approved-vendor-list mindset couldn’t move past buying software, even when building something custom would fit better and cost less. The fix isn’t banning the behavior, it’s putting someone who thinks about security into the process from day one, whether that’s an internal IT lead or an outside consultant.
Turn Your Chat History Into Company IP Here’s a shift worth sitting with: the valuable part of your team’s AI conversations isn’t the raw data you fed the model. It’s the decisions and rules you worked out along the way, and right now that knowledge is trapped in chat logs instead of living somewhere your company actually owns. Loren’s team builds structured “assistants” that capture this logic in files the business controls, independent of which AI tool anyone happens to be using that week. The upside for security teams: it turns a fuzzy, model-dependent process into documented, auditable business logic.
Scope Small, Ship Fast The number one reason AI projects stall isn’t technical. It’s scope. Try to solve five problems at once and everyone bogs down arguing about requirements. Solve one problem, get it into production, and people start lining up to add the next piece because they can finally see it working. One team applied this to a delivery routing problem and went from an 80% on-time goal to 100%, not by throwing more AI at it, but by using AI to build a simple script that reruns hourly.
Bottom Line: The developers most resistant to AI right now are often the ones who should be leaning in hardest. The role isn’t disappearing, it’s shifting from writing every line of code to thinking critically about process, security, and what should actually get automated. Whether it’s an unofficial MCP connector routing sensitive data through someone’s personal server, or an employee building a tool that never gets a security review, the common thread is the same: the technology isn’t the risk. The absence of someone asking the security question is.
Tune into the full episode to hear why an AI-run “board of directors” is already a real thing at one company, what a four-hour argument between two AI agents taught Loren about better decision-making, and why nobody’s buying the “AI will replace developers” story once you actually watch how these projects get built.
🔗 Ep 96 – Building the Future: AI Coding, Agentic Advisors and Custom Tools
Listen wherever you get your podcasts. Subscribe to our YouTube channel to stay up to date on breaking cybersecurity news.
Learn more at www.itauditlabs.com
