In Spring 2026, a software developer was asked to perform a security audit of a mid-sized Node.js backend. Roughly 60% of the code had been generated with AI assistance. Yet the application passed every security check.
"No injection vulnerabilities, no obvious race conditions, decent error handling," the developer wrote in a Reddit post. "On paper, it was fine."
But then, they started reading the code, line by line.
"Functions that obviously belonged together were scattered across unrelated files because that's how the AI generated them in separate sessions," the developer said. "The auth middleware was written three different ways in three different places, all slightly different, all working."
The deeper they dug, the more troubling the picture became. When they asked the team why certain architectural decisions had been made or what the reasoning behind specific implementations was, nobody could answer.
The code worked, but the knowledge behind it was limited, to say the least.
"The AI didn't write bad code. It wrote code that nobody understood," the engineer wrote.
This Reddit post captured a challenge many organizations are starting to recognize. But this developer, at least, understood the stakes enough to audit the code and trace what had gone wrong.
Now consider what happens when the same tools land with finance, legal, HR, or marketing teams who connect to sensitive systems and data without understanding the risks.
A crisis born from good intentions
This behavior isn't usually malicious — it's often the opposite: employees responding to a top-down mandate to move faster with AI. Tools like Claude Code and Codex are making it easier for teams to build apps, agents, and automations. The term "vibe coding" is even starting to appear in job specs at Fortune 500 companies.
In response, many IT and security teams have locked down access to sensitive systems and data. But locks don't always hold — employees who hit this wall may even paste their own usernames and passwords straight into a vibe-coded script to get around it.
Every employee who answers this mandate is a potential source of ungoverned code. And as generative AI accelerates the pace of creation, IT and security teams are struggling to keep up.
Many organizations have little visibility into what software exists, who owns it, why it was created, or whether it can be safely modified or retired.
At Tines, we call this phenomenon "wild code" — because of how quickly code can spread and take root, faster than organizations can track, govern, secure, or maintain it.
The problem is only accelerating. “We potentially have a viral adoption phenomenon that’s not being gated by IT or even by the operations teams within individual business departments,” says seven-time CIO Mark Settle.
His concern is backed by data. According to IBM’s 2026 Tech Leader Study, 77% of organizations say AI adoption is outpacing their current governance capabilities. At the same time, 70% report that business teams are deploying technology faster than IT can track it, a gap that creates fertile ground for wild code to grow.
An old problem that grows exponentially
The idea that technology can spread beyond IT's control is not new. For decades, organizations have wrestled with similar challenges: employees bringing personal smartphones and laptops into the workplace, and entire departments adopting cloud applications without IT's knowledge.
Code has long followed the same pattern. Internal scripts or custom applications have often been built outside formal processes. “There weren’t many organizations capable of governing the code hitting their production environments before AI came along,” Adam Arellano, Field CTO at Harness, notes.
There was already a lack of governance, but with generative AI, the problem is much worse. Arellano also talks about “the explosion of scripts and applications outpacing an organization’s ability to govern them,” a challenge that's becoming impossible for organizations to ignore.
Traditional governance assumes that software development follows certain rules and processes. That applications are planned, reviewed, documented, and deployed through established channels. But this hypothesis no longer holds, and conventional controls are beginning to show their limits.
The cost of wild code
Whatever way you look at it, wild code carries a hefty price tag. “The hidden costs are the long-term support costs,” says Settle.
The ongoing labor and risk cost of keeping ungoverned code alive, working, and secure over its lifetime is significant — and what's more, it's missing from the "look how fast we built this" narrative of AI-assisted development.
When organizations consider the cost of wild code, several distinct factors can erode the bottom line — some direct and immediate, others opportunity costs:
IT team burden. Every ungoverned script someone has to track down, audit, or fix is time and expertise diverted from higher-value work.
Technical debt. Scripts that aren't documented, tested, or reviewed add to a growing backlog of code that's fragile, hard to change, and riskier to keep running.
Untracked AI spend. Employee-built apps and automations rack up ongoing AI/API costs with no clear owner monitoring usage.
Inefficient design choices. Choosing AI agents when deterministic workflows are better suited to the job adds unnecessary cost, latency, and failure points, but non-engineering teams aren't always equipped to make that call.
Duplicated effort. Without visibility into what already exists, teams end up building the same tool in different silos.
Security and compliance exposure. Unmanaged code expands the attack surface, and the stakes are high: the average data breach now costs $4.4 million, according to IBM.
To Settle’s point, the real hidden cost is in the maintenance burden AI-written code creates over time. According to an analysis of over 300,000 AI-generated commits, nearly one in four quality and security issues remained in production, adding to organizations' technical debt.
As that debt grows, developers spend more time cleaning up and less time building. They chase down unfamiliar code and fix problems that should never have existed in the first place. That same lack of visibility is what makes wild code so hard to secure.
Organizations can't protect what they don't know exists.
Better governance is needed
It's tempting to frame wild code as a people problem ("blame the rogue employees!") or a technology problem ("blame the AI models!"). But really, it's a governance problem.
Employees who rely heavily on AI to write code are often doing exactly what they've been encouraged to do: work faster, increase productivity. Or they simply respond as they can, choosing the path of least friction, especially when they're under pressure to deliver results with fewer resources.
The answer isn't to discourage AI adoption or blame employees for using it. It's to build governance that keeps pace with innovation. That requires a proactive, organization-wide approach that reaches beyond IT, security and compliance teams.
“For me, governance should be organizational wide, not limited to software, the IT function etc.,” says Marijn Janssen, full Professor in ICT & Governance at Delft University of Technology.
Settle agrees. “IT and security teams have a unique opportunity to avoid a lot of contentious downstream debates by introducing construction guidelines now and educating early adopters about some of the security, cost, data quality concerns, etc. that they will inevitably encounter,” he added.
At the end of the day, business and IT leaders need to share responsibility for how AI is used across the enterprise, starting with what "success" actually means. As Arellano puts it, "Use AI to increase the quality of what you're producing — not just the volume. Make sure code hitting production is reliable, resilient, and has gone through proper testing and security oversight."
None of this is a call to slow down. It's a call for a new approach to AI-assisted building for all teams. The organizations that get ahead of wild code won't be the ones that restrict who gets to build — they'll be the ones that give every team, technical or not, a safe, secure, and governed environment to build in from the start. That's not a compromise between speed and control. It's what makes both possible at the same time.