Vibe Coding: Why Letting AI 'Vibe' With Your Code Is a Ticking Time Bomb

Vibe coding sounds great: you describe what you want to an AI and it writes the code. You do not read the code, you do not review it, you just “vibe.” The term was coined by Andrej Karpathy, co-founder of OpenAI, and has since exploded in popularity. According to Stack Overflow, 84% of developers are already using or planning to use AI tools for coding.

The problem is that nobody is talking about what happens when those “vibes” reach production.

The data paints a concerning picture: 45% of AI-generated code contains security vulnerabilities. AI contributions to open source projects are so poor that maintainers are shutting their doors. And a new generation of “developers” can build functional products but cannot debug them when they break.

The Numbers Nobody Wants to See

The Veracode GenAI Code Security Report analyzed 80 programming tasks across more than 100 language models, in Java, JavaScript, Python, and C#. The results:

• 45% of generated code had security vulnerabilities
• In Java, the failure rate exceeded 72%
• 86% of samples were vulnerable to Cross-Site Scripting
• 88% were vulnerable to log injection
• Security did not improve with larger or newer models

That last point is key: this is not a problem solved by the next model release. LLMs are getting better at writing functional code but not secure code. This is an architectural limitation, not a temporal one.

The CodeRabbit analysis of 470 GitHub pull requests confirms the pattern: AI-coauthored code had 1.7 times more “critical and major” issues than human code. Readability problems were 3 times more frequent. Performance issues (excessive I/O) were 8 times more common.

And then there is Lovable, the Swedish vibe coding startup. A researcher scanned 1,645 applications built with Lovable and found that 170 allowed anyone to access user personal information: names, emails, financial data, and API keys. Escape.tech expanded the analysis to 5,600 vibe-coded applications and found over 2,000 vulnerabilities and 175 instances of exposed personal data.

The Open Source Rebellion

Open source project maintainers are doing something unprecedented: closing their doors to external contributions because of AI.

Daniel Stenberg, creator of cURL (the tool used by virtually every server on the planet), shut down his bug bounty program after six years. The reason: an “explosion of AI slop reports.” In previous years, over 15% of reports were real vulnerabilities. In 2025, the rate dropped below 5%. “Not even one in twenty was real,” Stenberg wrote. AI reports were not just useless but consumed enormous time and energy to debunk. “The never-ending slop submissions take a serious mental toll to manage and sometimes also a long time to debunk.”

Mitchell Hashimoto, creator of Ghostty, was more direct. First he required all contributions to declare AI usage. Then he adopted a zero-tolerance policy: drive-by contributions are closed immediately, repeat offenders are permanently banned. His quote: “This is not an anti-AI stance. This is an anti-idiot stance.”

The irony: Hashimoto and his team use AI daily to write Ghostty. The problem is not the tool, it is who uses it and how.

Steve Ruiz, creator of tldraw, closed all external pull requests entirely. “In a world of AI coding assistants, is code from external contributors actually valuable at all? If writing the code is the easy part, why would I want someone else to write it?”

RedMonk dubbed this trend the “AI Slopageddon.” Stack Overflow saw a 25% drop in activity within six months of ChatGPT launching. Tailwind CSS documentation traffic fell 40% and its revenue dropped 80%.

AI Needs Senior Supervision, Not Less Supervision

Research presented at ICSE 2026 (the most important academic conference in software engineering) analyzed 518 practitioner testimonials about vibe coding. Their conclusion: “Vibe coding lowers barriers and accelerates prototyping, but at the cost of reliability and maintainability.” The researchers identified a new class of vulnerable developers: people who can build a functional product but are unable to debug it when it breaks.

CAST Software analyzed 10 billion lines of code and detected a 4x increase in “code cloning”: AI copies and pastes similar blocks instead of creating reusable logic. The result is what they call the “slop layer”: code that works but nobody understands why, and nobody can fix when it breaks.

Only 3% of developers fully trust AI-generated code. 71% refuse to merge it without manual review. 45% say debugging AI code takes longer than writing it from scratch.

The conclusion is clear: AI as a code generation tool is extraordinary. But without a senior engineer who reviews, understands, and validates what it generates, it is a factory for technical debt and security vulnerabilities.

How We Use AI at NERVICO

Vibe coding is like giving a scalpel to someone without medical training. The tool is excellent. The problem is who uses it.

At NERVICO, we use AI as a multiplier for senior engineers, not as a replacement for human judgment. Specifically:

What AI does for us:

• Accelerates boilerplate code generation and repetitive patterns
• Assists with dependency discovery and system documentation
• Suggests implementations that a senior reviews, modifies, and validates
• Runs testing and static analysis tasks

What AI does not do for us:

• It does not make architecture decisions
• It does not write code that goes to production without human review
• It does not replace judgment on security, performance, and maintainability
• It does not substitute domain knowledge of the business

The difference between vibe coding and AI-assisted engineering is the same as between giving a piano to a child and giving it to a professional musician. Both produce sound. Only one produces music.

If your company is evaluating how to integrate AI into its development process without sacrificing quality or security, our free technical audit can help you find the right balance.