Where's the API key for that Slack automation you vibe-coded with Claude or Cursor last week? If it's sitting in plain text inside the script, there's a system running right now that your security team doesn't even know exists — and it's touching company data.
Your Security Team Doesn't Even Know It Exists
Tines, the security automation company, kept seeing the same pattern across customer conversations — so they gave it a name. "Wild Code." Software employees build with AI outside formal IT processes, connected to internal systems and data, with zero record of what's running, who owns it, or whether it can be trusted.
Tines CEO Eoin Hinchy put it this way: "AI has made building software almost effortless. The hard part is connecting that software to your systems, knowing what's running, whether you can trust it." Building got easy. Watching it didn't.
This isn't hypothetical. When IBM surveyed 2,000 tech executives across 33 regions in June 2026, 77% said AI adoption has already outpaced their governance capabilities. Meanwhile, marketers' reporting automations, developers' deploy scripts, and ops teams' alert bots keep quietly spreading across the org, unnoticed. In fact, 85% of developers now use AI tools regularly for coding, and 62% use at least one AI coding assistant or agent.
The Numbers Are Worse Than They Sound
This isn't an abstract risk — actual scans back it up. Security firm Escape.tech scanned 5,600 AI-built applications and found over 2,000 vulnerabilities, 400+ exposed secrets, and 175 instances of exposed PII. Veracode's 2025 study found 45% of AI-generated code contains OWASP vulnerabilities, and CodeRabbit's analysis found AI code has a 2.74x higher vulnerability rate than human-written code.
Credential exposure isn't someone else's problem either. GitGuardian's 2026 annual report found 24,008 secrets exposed in MCP configuration files on public GitHub alone — 2,117 of them still valid, working credentials at scan time. In 2026, CVE-2025-53773 showed a hidden prompt injection in a pull request description could trigger remote code execution in GitHub Copilot, scoring 9.6 on CVSS. Real breaches followed the same pattern — Moltbook leaked 1.5 million auth tokens and 35,000 email addresses; Tea app leaked 72,000 user images and 1.1 million private messages.
And this risk isn't confined to cutting-edge coding agents. Of the 53 security projects OWASP tracks, more than half deal with coding agents — and n8n alone racked up 57 security advisories, the most of any project. Your familiar no-code automation tool isn't exempt.
Tines' Answer — Proxy, Isolation, Audit Trail
Tines was founded in Dublin in 2018 by Eoin Hinchy and Thomas Kinsella, both former security engineers at DocuSign and eBay who thought existing SOAR solutions were "too complex and rigid". Since then, the company has landed customers like Coinbase, Reddit, and SAP, raising $272M and reaching a $1.125B valuation.
Tines 3B, launched in late July 2026, goes straight after the Wild Code problem. The approach has three parts.
- Build
Natural-language requests assemble workflows only within already-approved tools and connectors. No bolting on random APIs. - Run
Credentials never touch the code directly — they're injected via a runtime proxy. Every workflow step runs in a fully isolated environment that disappears when it finishes, making cross-contamination between users architecturally impossible. - Monitor
Every app, agent, and automation running in the company shows up on a single screen, with every action logged for audit.
Emanuele Sparvoli of Fin described it as "an environment where employees can build workflows while our IT team retains the control and governance needed". Worth noting: Tines also opened a free Explore Edition with unlimited users and connectors for up to 3 live workflows.
A principle worth keeping even without Tines
Meta's agent security guidelines describe a "lethal trifecta": ① access to private data ② exposure to untrusted content ③ the ability to communicate externally. If a single automation has all three at once, it should never run without human approval. That's a checkpoint you can apply regardless of what tool you use.
| Just building and shipping it | Adding minimal controls | |
|---|---|---|
| API keys | Pasted directly into the script | Kept in env vars or a secrets manager |
| Permission scope | Reuses your full account access | A dedicated, minimal-scope token |
| Ownership record | Only the builder knows it exists | Owner, purpose, last-updated logged |
| External input | Untrusted content processed as-is | External content gets separate validation |
Audit Your Automation in 5 Minutes, Starting Now
You don't need a governance platform like Tines to start today.
- Check where your API keys live
Open the script and see if keys or passwords are hardcoded. If they are, move them to env vars or a secrets manager immediately. - Run the lethal trifecta check
Does this automation access private data, process external content, and communicate externally, all at once? If yes, add a human approval step. - Narrow the permission scope
If it's reusing a full-workspace token, swap it for one scoped to just the channels or sheets it actually needs. - Log the owner and purpose
Even one line helps — who built it, why, and when it was last touched. - Tell your security team it exists
Even if it looks small, if it touches company data, get it reviewed. Disclosing it now is far cheaper than explaining it during an incident later.
Go Deeper
The making of Tines 3B Tines' own team on building 3B, including where the term Wild Code came from tines.com
Tines 3B official launch release The Build/Run/Monitor framework and customer quotes, straight from the press release prnewswire.com
Why Tines is trying to tame "wild code" SiliconANGLE's deep dive into market reaction and competitive positioning siliconangle.com
Tines' founding story How two ex-DocuSign security engineers built a SOAR company, plus its 2022 funding round techcrunch.com
The 2026 AI code security crisis, in numbers Veracode, CodeRabbit, and Escape.tech vulnerability stats in one place blog.vibecoder.me
How prompt injection drives agentic AI security failures The "lethal trifecta" principle and OWASP's tracked-project vulnerability rankings helpnetsecurity.com
