Citizen developers—employees who create software outside traditional engineering teams—are increasingly using AI coding tools to build and deploy applications, often without IT oversight. The term covers business users such as sales representatives and operations managers as well as professional developers working outside their usual specialties. Gartner found in 2021 that 41% of employees created technology or analytics capabilities outside IT departments, before ChatGPT’s release. The growth of AI-assisted development can accelerate shadow IT, including applications that handle personal data or connect to company systems without established security, compliance, cost, or operational controls. The post argues that operations and platform teams should provide AI agents with company-specific deployment paths rather than attempting to block citizen development. Suggested controls include a supported application runtime, deployment workflow, identity and secret-management process, and defined points where an agent must request human review. It cites an October research scan of 5,600 production “vibe-coded” apps that reportedly found more than 2,000 vulnerabilities, 400 leaked secrets, and 175 exposures of personal data. It also cites Moltbook’s leak of 1.5 million API tokens through a Supabase key in client-side JavaScript three days after launch. The Cloud Security Alliance says major AI security frameworks, including NIST AI RMF and the OWASP LLM Top 10, lack dedicated guidance for citizen developers operating without professional security oversight.