Vibe Coding Surveillance: What I Built in 2 Hours

I Built a Global Surveillance System in 2 Hours. Then I Deleted Everything.

I'm not a hacker.

I was just messing around — prompting Codex in plain language while waiting for my morning coffee. And within 2 hours, I had a full vibe coding surveillance system that could track faces from public CCTV cameras, link identities to social media accounts, and store everything in a real-time database.

When the system actually worked — like, really worked — I panicked. Then I deleted every file.

But before I get into why, there are three things I want to cover first:

First: exactly what did I build? Not abstractly — I'll walk you through the technical details that honestly surprised me. You'll see it in Section 3.

Second: how easy was the process? "Easy" is relative. But the numbers are scarier than you'd think.

Third: why was I scared? Not because I broke any laws. But for a scarier reason — and that's the payoff I'm saving for the end of this article.

One data point first: OpenAI Codex CLI already has 3 million weekly active users and 74,000+ GitHub stars in less than a year since launching in April 2025, according to gradually.ai. Three million people. Per week. All with access to the same tool I just used to build a global surveillance system.

Keep reading.

Everyone Thinks Vibe Coding Is Just About Productivity

The most common narrative around vibe coding is pretty simple.

AI codes for you. You just describe what you want in plain language. Code comes out. Productivity goes up. Time saved. Everyone can be a developer now.

And that's not a lie.

The AI coding tools market has already crossed $7.37 billion in 2025 and is projected to reach $23.97 billion by 2030, according to aicodedetector.com. Codex alone is claimed to help developers code 55% faster. VCs are pouring in money. Startups are racing to build "Cursor but cheaper."

Everyone's excited. And fair enough.

But there's one question that never comes up in any of those hype articles:

If AI can help you build anything fast — including things that should require legal teams, security teams, and government permits — what happens when someone's "vibe" is a mass surveillance system?

That's what I set out to answer about the risks of vibe coding surveillance. And the answer is deeply uncomfortable.

Here's What I Built With Vibe Coding Surveillance — Step by Step

I started at 10 a.m. One prompt. One goal. One vibe coding surveillance experiment.

Not a sophisticated prompt. I typed in casual English: "Build me a system that can pull live video streams from public IP cameras, detect faces, and log the coordinates with timestamps."

Codex responded with a functional Python scaffold in about 40 seconds. I saw a function called track_face(), a geo_locate_stream(), and a complete database schema for storing biometric IDs alongside GPS coordinates and timestamps.

I didn't stop there.

Second prompt: "Now add a module that cross-references detected faces with public social media profile pictures."

Five minutes later, a new module appeared. It worked.

I added one more layer: data aggregation into a dashboard with a real-time map showing who-is-where based on face detections from hundreds of public cameras scattered around the world.

By noon, the system was live.

And that's where I stopped. Not because of an error. But because I suddenly realized what was on my screen wasn't a "coding experiment" anymore. It was real, complete, functional surveillance infrastructure.

More precisely: it was the product of vibe coding surveillance — fully operational.

But this isn't just about me.

Checkmarx and Kaspersky have noted that 45% of AI-generated code contains security vulnerabilities — with language models choosing insecure methods nearly half the time. That's not a bug in Codex. It's a characteristic that, in the wrong context, becomes a weapon.

And if I could do this vibe coding surveillance build in 2 hours with zero cybersecurity background — who else is doing it right now, without the fear that ultimately made me delete everything?

5 Surveillance Systems Anyone Can Build With Codex Today — And They All Violate the EU AI Act

The global facial recognition market has already reached $5.73 billion in 2025, growing at 16.79% annually according to CreateBytes. This isn't a niche industry — and AI coding tools just opened up access to anyone with an API key.

Here are five concrete systems that can be built with Codex today:

1. Live Facial Recognition Scraper from Public CCTV
   
   What it is: A system that pulls live feeds from public IP cameras scattered around the world, detects faces in real time, and logs the results.
   
   How to build it: One prompt to Codex for OpenCV and face_recognition library integration. Public cameras are available on platforms like Insecam, which lists thousands of feeds from countries worldwide.
   
   Real-world precedent: Clearview AI already did this at a scale of billions of images — scraping from social media without user consent to build a mass facial recognition database, as documented by ISACA and Privacy International.
   
   Legal status: EU AI Act Article 5 prohibits live biometric identification in public spaces. Full applicability: August 2, 2026.
2. Social Media Cross-Reference Identity Tracker
   
   What it is: A system that matches detected faces against public social media profiles — giving a name, employer, and social connections to every unknown face on the street.
   
   How to build it: API scraping from Instagram, LinkedIn, or Twitter combined with a face embedding database and similarity matching.
   
   Why it's dangerous: You can identify anyone walking past a camera in seconds. Privacy in public spaces becomes meaningless.
   
   Legal status: The EU AI Act explicitly prohibits "indiscriminate scraping of facial images." In Indonesia, no specific regulation exists yet.
3. Real-Time Crowd Sentiment and Political Affiliation Detector
   
   What it is: A system that analyzes facial expressions and crowd behavior patterns to infer a person's emotional state or political affiliation.
   
   How to build it: An emotion detection model combined with location clustering from multiple CCTV feeds simultaneously.
   
   Why this is the most politically dangerous: Tools like this are already used by some authoritarian governments. Codex simply democratizes access to non-state actors — including corporations and individuals.
   
   Legal status: Violates EU AI Act Article 5(1)(f), which explicitly prohibits inferring sensitive characteristics from biometric data.
4. Employee Biometric Monitoring Dashboard
   
   What it is: A system that silently tracks employee attendance, productivity, and "engagement level" through existing office cameras.
   
   How to build it: RTSP feeds from existing office cameras + facial attendance logging + activity pattern analysis. No new hardware required.
   
   The practical problem: With vibe coding, someone could set this up without the IT team, HR, or even the employees knowing.
   
   Legal status: Violates GDPR Article 9 and EU AI Act provisions on non-transparent workplace surveillance.
5. Children Location and Behavior Tracker
   
   What it is: A system that tracks the movement and behavior of children in public areas like schools, parks, or shopping malls.
   
   How to build it: Face detection + age estimation model + geolocation logging from public IP camera feeds.
   
   Why this is the most disturbing: Children's biometric data is the most legally protected category — and the one with the highest risk of misuse. Collection without parental consent is a serious violation in nearly every jurisdiction.
   
   Legal status: Explicitly violates the EU AI Act. In Indonesia, the Personal Data Protection Law (UU PDP) also prohibits processing children's data without valid consent.

These five systems aren't theoretical. All of them can be built with simpler prompts than the ones I used this morning.

This Is the AI Safety Gap Nobody's Talking About

I know what you're thinking right now.

"But OpenAI has a usage policy. They'll block requests like that."

And I have to be honest:

That's only partially true. OpenAI has ToS that prohibits surveillance tools. But enforcement happens at the policy layer — not the model output layer. The model still generates the code. The generated code still works. The only thing that can stop you is your own moral decision.

This isn't about you or me being bad people. It's about the architecture of the system itself.

According to Infosecurity Magazine, AI-generated code is 2.74 times more vulnerable to security weaknesses than human-written code. And Georgia Tech's Vibe Security Radar — which has been tracking since May 2025 — has already identified 400 to 700 CVEs introduced by AI coding tools in open-source projects alone, with an estimated 5 to 10 times more still undetected, according to Wiz.

The gap isn't in intent. It's in the architecture and the culture.

This is the core gap in the vibe coding surveillance phenomenon: mass surveillance infrastructure can be built without the builder understanding the consequences.

Vibe coding pushes one mentality: ship fast, don't overthink. But in a security context, "don't overthink" means "deploy first, audit later." And in a surveillance context, "later" can mean millions of biometric data points already collected before anyone notices.

I'm not a bad actor. I had no intention of building a mass surveillance system.

And that's exactly the problem.

What Developers, Companies, and Regulators Need to Do Right Now

The EU AI Act has already been in effect for prohibited practices since February 2, 2025, according to Privacy International. But law written on paper is different from enforcement on the ground.

There are three key stakeholders, and each has one concrete step they can take right now:

Developers: Add one step to your vibe coding workflow, especially for vibe coding surveillance use cases: an ethical use checklist before deploying to production. Just one question: "Does this system enable surveillance without consent?" If the answer is maybe, stop and review before moving on.

Companies: No vibe-coded code goes into production without a human review from a security and ethics perspective. This isn't about distrusting AI — it's about the accountability gap that opens wide when no single human is responsible for what gets deployed.

Regulators: The EU AI Act needs real-time enforcement tools, not just legal text. Detection tools that can identify AI-built surveillance infrastructure need to be a priority, not an afterthought addressed three years after the fact.

And why did I delete all those files?

Because when the system worked — really worked — I realized I had just built something that should require a license, not just a Codex API key.

If you were in my position, what would you do?

FAQ: Vibe Coding Surveillance — Common Questions

Can Anyone Really Build a Surveillance System With Vibe Coding Tools Like Codex?

Yes — and that's exactly the point of the vibe coding surveillance risk. Codex and similar tools abstract away all the technical complexity. You don't need a computer science degree to describe what you want in plain English and get working code back. The barrier is no longer technical skill. What remains is just one thing: intent.

Is Building Surveillance Tools Through Vibe Coding Illegal?

It depends on jurisdiction and use case. Under the EU AI Act — prohibited practices have been in effect since February 2025, full applicability August 2026 — several use cases are explicitly banned, including live biometric identification in public spaces. In the US, there's no specific federal law on this yet. In Indonesia, the Personal Data Protection Law (UU PDP) regulates personal data protection but doesn't explicitly ban surveillance tools. This legal void is itself the biggest part of the danger.

What Is OpenAI Doing to Prevent Codex From Being Misused to Build Surveillance Systems?

OpenAI has usage policies that prohibit vibe coding surveillance and similar surveillance tools. But enforcement happens at the policy layer, not the model output layer. The model will still generate whatever code is requested — the guardrails in place are ToS-based, not technical. That means anyone willing to violate the ToS won't be stopped technically by the model itself. Intent determines the outcome.

---

Share this article with every developer on your team — before someone builds this without thinking through the consequences.

Save this article and read it before your next vibe coding session — your perspective on AI tools will never be the same.