Cleverbit talks about “vibe-code drift” in Nissy’s workflow security
The era of AI-assisted coding is over. The industry is entering the era of Agentic SDLC (Software Development Life Cycle). With this new way of working, developers are no longer just writing code; they carry a purpose behind it.
Purpose Management
The biggest challenge with agents is that they make independent decisions. They don’t just do your bidding; they translate them. This can lead to problems. An agent may introduce security vulnerabilities, build features you didn’t request, or modify your properties in ways you didn’t intend.
Engineering company Cleverbit Software calls this code vibe drift. It happens when the gap between what you want and what the agent actually builds gradually grows, creating “dark code” that the developer no longer fully understands, controls, or can reliably interpret, despite being constantly accountable for it.
Organizations see immediate benefits from AI-generated code, but as soon as developers stop writing code, it negatively impacts the entire flow. “You will have obstacles, you will have new risks that you need to face, and you will have challenges working with the team,” explained Eman Zerafa, CTO at Cleverbit. “And that means the team needs to find a way to use AI throughout the SDLC responsibly. At Cleverbit, we’ve been using AI throughout the SDLC for some time. We’ve built tools to help with requirements gathering and testing and pipelines, and we’ve created various capabilities along the way.”
Since developers are now writing much less code, the job is now to set the goal and ensure the result. Developers should be clear about who they are building, how they are tested, and what decisions they are overseeing.
Best Ways
Apart from the tools, success in agent engineering requires discipline.
Among the best practices are:
Edit Content: Do not feed the agent everything. Too much information creates noise
and lower the model. Keep your content files short and to the point.
Automatic Verification: Use automatic tools, such as lining and static analysis, to
check the code. Make this a regular part of your pipeline. Zerafa commented that “if you
have default validators, must be different from code generators, or do
sure that the builders have a completely different context.”
Keep Records: Treat AI programs like valuable documents. Saving these plans helps yours
the team understands why certain decisions were made, even if the agent made the original
to write.
Protect Human Attention: Use AI throughout the SDLC but always use humans
to judge decisions of great consequence. Nissy helps reveal these moments, so only you
spend time reviewing what really matters.
Nissy said quietly
To address this new workflow, Cleverbit created Nissy – a workflow tool that keeps developers tied to their AI agents, bringing people back into the loop where it matters.
Nissy works in two main ways: checking your intent before the code is created, and checking every action the agent performs. Before the notification reaches the agent, Nissy reviews it locally for PII and sensitive information, which acts as a safety net in case of accidental leaks. Then, Nissy checks the intent against best practices and project-specific rules, helping you understand where directives are likely to go beyond the lines of caution. Once the agent has generated the code, Nissy compares it to the original intent. It catches silent mistakes, like overbuilding a simple feature or ignoring the constraints you set.
Nissy is an R&D project designed with privacy at its core: work is processed without data storage, so proprietary code and information never get out.
Nissy also answers the most difficult question: is your organization using AI correctly? Build a measurable, dynamic picture of usage over time, uncover recurring failure modes and recommend concrete improvement actions.
“Nissy exists because we set out to measure vibe code drift by having a local tool that evaluates your workflow. That quickly became an assistant that helps you stay in control of your code,” said Ethan Zammit, AI solutions engineer at Cleverbit. “So this does this by attaching to different parts of the agent’s command loop and it helps to come up with better information and be more selective about what you put in.”
That, he explained, reduces the verification burden of directing the agent and closes the loop between what the generated code is and what the initial information was.
Watch the recorded webinar here: Agentic Software Development Explained | Webinar
Moving Forward
The goal of this new style of engineering is not to replace engineers; is to help them own the software you produce. The difference between a top team and a struggling team will be the structure they build around their agents.
With tools like Nissy, users can maintain AI speed while maintaining high standards. Developers can build faster, but with more confidence, better security, and clearer goals. Agents are struggling, but the developer is always in charge.
