Definition: AI app sprawl is the uncontrolled accumulation of AI-built internal tools across a company — apps created in Lovable, Bolt, v0, Claude Code, or Cursor by many different people, running on personal accounts and scattered hosting, with no shared inventory, access policy, or off switch.
Sprawl is a success problem: each individual tool exists because it's useful. AI builders dropped the cost of an internal app from an engineering-sprint to an afternoon, so the tools multiply — and the accumulation itself becomes the risk.
How sprawl happens
- An analyst builds a revenue dashboard with Claude Code; it runs on a personal Vercel account.
- The COO builds an approvals app in Lovable; it's shared from Lovable's workspace.
- A founder builds a customer-data cleaner in Cursor; it lives on a laptop that sometimes sleeps.
- Each is a reasonable local decision. Eighteen months later there are forty tools in eleven places, six former employees still hold working links, and no list of any of it exists.
Why it's a risk multiplier
- No inventory — the fleet can't be secured because it can't be enumerated.
- Credential exposure — vibe-coded apps routinely embed API keys; sprawl scatters those keys across builders' accounts and chat histories.
- Orphaned tools — the builder leaves; the tool keeps running (until it breaks) with nobody accountable.
- Access drift — links keep working for people who shouldn't have them; there's no company login in front of the tools.
- Compliance dead-ends — "how do you govern internal tooling?" on a security questionnaire has no honest answer.
The remedy
Sprawl isn't fixed by policy documents; it's fixed by giving the tools a better place to live than personal accounts: an internal tools control plane — one registry behind the company login, with secrets management, audit, rollback, and a kill switch per app. That's what VibeHub is: build wherever you like, run it in the workspace. See also vibe coding governance.