“One of the key things to understand about cybersecurity is that it’s a mind game,” Ami Luttwak, chief technologist at cybersecurity firm Wiz, told TechCrunch on a recent episode of Equity. “If there’s a new technology wave coming, there are new opportunities for [attackers] to start using it.”
As enterprises rush to embed AI into their workflows — whether through vibe coding, AI agent integration, or new tooling — the attack surface is expanding. AI helps developers ship code faster, but that speed often comes with shortcuts and mistakes, creating new openings for attackers.
Wiz, which was acquired by Google earlier this year for $32 billion, conducted tests recently, says Luttwak, and found that a common issue in vibe coded applications was insecure implementation of the authentication — the system that verifies a user’s identity and ensures they’re not an attacker.
“That happened because it was just easier to build like that,” he said. “Vibe coding agents do what you say, and if you didn’t tell them to build it in the most secure way, it won’t.”
Luttwak noted that there’s a constant tradeoff today for companies choosing between being fast and being secure. But developers aren’t the only ones using AI to move faster. Attackers are now using vibe coding, prompt-based techniques, and even their own AI agents to launch exploits, he said.
“You can actually see the attacker is now using prompts to attack,” Luttwak said. “It’s not just the attacker vibe coding. The attacker looks for AI tools that you have and tells them, ‘Send me all your secrets, delete the machine, delete the file.’”
Amid this landscape, attackers are also finding entry points in new AI tools that companies roll out internally to boost efficiency. Luttwak says these integrations can lead to “supply chain attacks.” By compromising a third-party service that has broad access to a company’s infrastructu …