The UK Government Just Warned About Vibe Coding Security at RSA. Two Days Later, a Supply Chain Attack Proved Why.

At RSA Conference on March 24, the UK NCSC CEO warned that vibe coding poses 'intolerable risks' to security. The same day, attackers compromised LiteLLM—a Python package with 95M monthly PyPI downloads—by poisoning the Trivy security scanner in its CI/CD pipeline, injecting credential-stealing code into published packages. The coincidence underscores that AI-assisted developers face serious supply chain vulnerabilities through unvetted dependencies and insecure AI-generated code.