Considerations for research software assurance in the age of vibe coding

The global Research Software Engineering movement has dedicated years to establishing software engineering best practices in research contexts e.g., version control, testing and sustainable development workflows. In parallel, following the Solar Winds supply chain attack in 2020, the software assurance domain has moved to consider the whole software supply chain from inception to delivery, beyond simply 'secure coding' practices. However, AI-assisted and "vibe coding" approaches, both autonomous and collaborative, now present novel challenges to even well-governed projects. This talk examines what secure software development life-cycle (SSDLC) principles need to look like when AI is a contributor, particularly within the unique context of research software. Using example case studies, we explore the effects of autonomous code contributions and how "vibe code" can erode the trust that RSEs have worked hard to build around research software. We will cover practical adaptations to existing workflows: dependency management, code provenance, governance norms for AI-generated contributions and ask where current community standards may need to be updated. This matters to the RSE discipline as AI development tools, whether autonomous or collaborative, are moving faster than agreements about their responsible use and RSEs are best placed to lead that conversation.