Vibe coding in legal: what an AALL panel actually found
Vibe coding keeps showing up in legal tech conversations as the shortcut that lets non-developers ship software. Ask the chatbot, get the code, ship the thing. At a packed session at the American Association of Law Libraries (AALL) conference, three panelists who are serious about legal tech put that premise to a real test.
The result was more cautionary tale than endorsement.
The demos did not go well
Each panelist attempted a vibe coding project specifically for the presentation. One tried to build an app that synthesized data from multiple sources. A second tried to build an app teaching Boolean search concepts. A third tried to scrape information from various sources.
Of the three, only the second panelist was marginally successful. All three spent substantial time trying. That outcome, from experienced legal tech professionals who are well ahead of the average lawyer on AI literacy, is a signal worth taking seriously.
The risks they named
None of the three panelists would use vibe coding on their employer’s systems. Their workplace policies did not explicitly ban it yet, but all three did their demo projects on personal computers on personal time. That gap between policy and practice is its own data point.
Beyond policy, the panelists flagged five concrete risk categories:
- System security: Without substantial expertise, vibe-coded tools can compromise security or corrupt system architecture. The panelists described a worst case where all files could disappear.
- Data policy violations: Most organizations have rules about where institutional data can be stored and processed. Vibe coding by someone unfamiliar with those constraints can breach them without the coder realizing it.
- Overengineering: It is easy to build something more complex than intended, which creates unexpected downstream problems.
- Autonomous action without oversight: Vibe-coded tools can take actions without direct human involvement or approval. That is by design. It is also exactly why an unsophisticated implementation can cause damage without anyone noticing.
- AI-generated malicious libraries: Like any LLM output, vibe coding can hallucinate dependencies or create libraries that open attack surfaces for hackers.
There is also a cost consideration. Vibe coding can consume significant tokens. If you rely on AI for other work, experimenting with vibe coding could constrain that usage or generate an unexpected bill.
What the panelists said it is actually good for
When asked directly, the panel went quiet for a long moment. The eventual answers: planning a party, creating interactive exercises, building games for kids, and pulling data from various sources (which was the one demo that partially worked). Not exactly a ringing endorsement for professional use.
The panelists also noted that anything beyond a very simple project requires IT involvement anyway. For lawyers at larger firms with in-house IT departments, the panel’s advice was direct: go to the experts first and skip the DIY detour.
If you still want to try it
The panel offered a practical checklist for anyone determined to experiment:
- Read up on it first. Check whether someone has already built what you need.
- Avoid anything that requires ongoing maintenance. Leave that for IT professionals.
- Keep the scope small. Simple projects only, where the blast radius if something breaks is limited.
- Start with the problem, not the prompt. Think through exactly what you want the code to do and, just as important, what you do not want it to do.
- Only use it on personal projects on personal machines until workplace policies catch up.
The broader pattern
The author draws a comparison to how legal professionals adopted AI generally: first fear, then personal novelty use, then cautious work use, then routine daily use. Vibe coding may follow the same arc. The AALL panelists’ current position is early in that curve, and the friction is real.
For solo or small firm lawyers with technical sophistication and an understanding of the risks, there may be a limited work use case today. For everyone else, the honest summary from the people who tried it is: not ready for professional use yet.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
