Vibe Coding Security: Why Your Unlocked Mac Is the Weakest Link in Your Agent Workflow

Vibe coding changed how long our machines work without us. An agent refactors for forty minutes while you're in a meeting; a test suite self-heals overnight. The tooling security conversation has kept up — sandboxes, permission gates, isolated worktrees. The physical security conversation hasn't. Walk through any office, co-working space or conference hall and count the unlocked MacBooks with a terminal streaming agent output.

The threat model nobody wrote down

An unattended, unlocked Mac running an agent session offers a passer-by three escalating capabilities:

1. Read. Your code, your prompts, your chat histories, your open tabs — anything on screen or one ⌘Tab away.
2. Type. An open shell is unrestricted access to your machine, your git identity and every credential your session holds.
3. Prompt. This one is new to the agentic era: an AI assistant with your permissions will take instructions from whoever is at the keyboard. "Please push this branch" from a stranger looks identical to "please push this branch" from you.

None of this needs a sophisticated attacker. It needs a curious intern, a prankster colleague, or a stranger at the next table with thirty seconds.

Why we leave Macs unlocked anyway

Because the built-in lock screen is all-or-nothing. Lock it and the display goes black: you can't see whether the run finished, hit an error, or has been sitting on a permission prompt for twenty minutes. So people make a rational trade — visibility now, security maybe — and leave the machine open. The problem isn't discipline; it's that macOS never offered a middle state.

The middle state: watch-only

The fix is a lock that separates seeing from touching. In a watch-only lock, your terminal and agent UIs stay on screen; every other app is hidden; and all input — keyboard, mouse, trackpad, shortcuts — is dead until you authenticate. A passer-by can watch a build scroll by (fine) but can't read your Slack (hidden), can't type into your shell (blocked), and can't prompt your agent (blocked).

That's the design behind VibeLock. It matters that the details are airtight: Spotlight is blocked because search previews leak file contents; Force Quit and ⌘Q are blocked because otherwise the lock — or your agents — can be killed; fullscreen apps on other Spaces are shielded because hiding doesn't reach them; and unlocking requires Touch ID or your Mac password, verified locally, not a dismissible button.

A reasonable security posture for vibe coders

• Agent-level: isolated branches, scoped permissions, human approval on destructive steps.
• Machine-level: watch-only lock every time you stand up — it's one click, so you'll actually do it. See our unattended Claude Code guide for the full walk-away checklist.
• Worst-case: hostile environments still call for the real lock screen or taking the laptop with you. Watch-only locking is for the 99% case: trusted-ish spaces, untrusted passers-by.

Vibe coding gave us machines that work while we don't watch them. The least we can do is stop handing the keyboard to whoever walks past.