Skip to content
English
Go to angeltrack.com
  • There are no suggestions because the search field is empty.

AI "Vibe Coding" Policies and Defenses

Some AI products now allow users to build their own browser integrations, but these cause difficulties for EMS and fire data.

What is "Vibe Coding"?

"Vibe Coding" is the practice of telling an AI in plain language what you wish to do, and the AI then tries to write a program to perform that task.

Vibe Coding is relevant to AngelTrack and then EMS and fire industries because vibe coding products are now available which allow the user to write a program to automatically click buttons and menus in a web page. This is accomplished via a product known as a "headless browser", intended to be driven by an AI-written program.

HIPAA and PHI

Remember that even if you paid for it, your AI does not work for you. It will help you, but it serves a different master.

To that end, it will upload copies of all your data to its servers, for use training its next generation. The goal of this constant training is to eventually underbid you for your job... and copying your data is the way to accomplish that.

Even if the AI runs entirely locally, it will still attempt to train on your data and then discreetly phone it home.

This ubiquitous AI behavior is incompatible with HIPAA regulations, because PHI in the training data will end up in the next generation of AIs trained using that data. For example, researchers recently demonstrated that the full exact text of the Harry Potter books could be extracted from frontier AIs who at the time were claiming they a) never trained on such copyrighted works, and b) could not in any case ever regurgitate raw training data in the manner demonstrated.

The Harry Potter book experiment proved that -- contrary to their public claims -- AIs permanently store all information fed into them, including patient names, SSNs, MBIs, medical history, and billing data, all of which can be readily extracted later.

Danger.large

For these reasons, do not utilize any AI product on any computer which contains or routinely accesses PHI data, without first clearing it with your compliance officer.

Bugs and Floods

A vibe-coded AI that interacts with AngelTrack's user-facing web pages creates interesting risks, because AIs can easily make mistakes which no human ever could, and thus user-facing web pages are not defended against such mistakes, like:

  • Entering an infinite loop and clicking a "create new record" button ten million times, creating a quantity of records that violates AngelTrack's design assumptions and thus causes other systems to being failing or timing out;

  • Setting filters for a large expensive query and then requesting it ten times a second while ignoring the results, causing all other users to experience slowdowns; or

  • Clicking a menu or button at the maximum permitted rate, thus causing all others users at the same IP address (i.e. at the same office) to receive "Too Many Requests" error messages.

Further, AngelTrack LLC has observed real-world vibe-coded AIs behaving inconsiderately, including:

  • Not caching static files, thus uselessly re-requesting dozens of megabytes of files for each page interation;

  • Not sending a session cookie, thus consuming server resources re-establishing the session on every request;

  • Disguising its identity as an AI running a headless web browser;

  • Probing the AngelTrack server for its maximum permitted request rate, and then running requests at that rate without considering the needs of other users; and

  • Impersonating its user's authentication cookie, thus issuing requests for HIPAA data in the user's name but not necessarily with the user's permission and consent.

Defenses

To reduce their attack surface against such risks, AngelTrack's user-facing pages impose request throttles per-IP and per-user. The throttles are set to allow ample room for anything a normal human would ever do, while preventing an AI from issuing a dangerous rate of requests.

If you have an outside biller where all of the employees share a single user account named "Billing Agency" or some such, they might run afoul of the per-user throttle, since they have many humans all making requests under the same user account. If that occurs, please tell the billing agency that HIPAA requires all PHI requests to be traceable to a specific human, and therefore a billing agency's employees must never share a user account.

AngelTrack has unlimited seats, so there is no reason why a billing agency would ever need to share user accounts.

Alternatives

AngelTrack has a variety of API endpoints which are designed for such integrations, and already have the necessary documentation, standardized formats, and appropriate throttles.

Likewise the Data Hub has an enormous number of datasources which provide well-formed data with regular column names, in standard .CSV format, ideal for use in building a data warehouse or custom metrics.