How to navigate thorny copyright questions around vibe coding

Let’s say you spend days vibe-coding a software tool. You prompt the code, tweak the features, incorporate feedback from your audience, and, finally, figure out how to launch it into the wild.

But do you actually own the result? For development teams everywhere, the rise of vibe coding has led to intense conversations around copyright and ownership.

Adam Aft, global head of tech transactions at law firm Baker McKenzie, told IT Brew that current copyright law does require some amount of human contribution and authorship to give a work copyright protection. That means companies using AI tools to code need to have a discussion about some key points.

“One of which is copyright authorship, documentation of authorship, and how they’re thinking holistically about protecting the output from AI and protecting what they are using, inventing, and creating as their proprietary technology,” Aft said.

What to watch out for. The use of vibe coding in software development could come up in business discussions, including licensing software to customers. Buyers may have questions about an organization’s IP and ownership of a particular piece of software. If an organization is unable to track vibe coded code within a codebase, it could negatively impact dealings about the pricing, timeline, and more.

Matt Savare, chair of commercial contracts at Lowenstein Sander and founder and CEO of sports commentary start-up Fansmit, told IT Brew that developers and their companies should evaluate the underlying intellectual property issues of their AI output.

“AI is astonishing in what it could do, but I think it gives people a false sense of security, and you really do still need to have that human involvement,” Savare said. “Even if it looks functional, it might mask underlying problems that legal experts and technology experts and bring them into the loop.”

Savare said IT professionals should also be concerned about the confidentiality and data protection side of vibe coding. For example, free versions of popular AI chatbots may use any proprietary information inputted in a prompt for training purposes. Vibe coding also raises significant risks.

According to Savare, vibe coding can incorporate code (such as dependencies and packages) that has “copyleft” licensing, which helps to ensure iterative versions of open-source software remain free to the public, or General Public License (GPL), which requires those who modify it to share any improvements or updates with the wider community.

If an organization ingests and uses code like this, Savare said the consequences could be “catastrophic.” In theory, anyone could access, use, reproduce, and create derivative works based on the software.

We’ve seen this film before. Aft said the use of open-source code has already prompted many development teams to institute rigorous policies and documentation around how software is built.

“We already have rigorous documentation of our software development life-cycle and where our developers are contributing,” Aft said. “We want to take a practical approach, and we just want to incorporate the notions of what everyone’s doing with these technologies.”

Learning from the tapes. In light of that, Aft said, organizations utilizing vibe coding should focus on identifying existing processes already used with open source that can be applied to vibe coding, such as testing and sandbox practices.

Aft also suggested that companies rigorously maintain documentation for what in their ecosystem is vibe coded and what is developed with human authorship. That’s in addition to organizations evaluating the IP and open-source risks of vibe-coded code introduced into their codebase.