Is Vibe Coding Bad? When It Works and When It Fails
The Honest Answer, Not the Hot Take
Vibe coding is not inherently bad. It becomes a problem the moment AI-generated code reaches production without review. Andrej Karpathy, who coined the term in a February 2, 2025 tweet, described it as work where you “fully give in to the vibes… and forget that the code even exists.” That framing was always meant for throwaway weekend projects, not for systems handling real users or real money.
The risk is measurable, not theoretical. Veracode’s 2025 GenAI Code Security Report, retested in its Spring 2026 update, found that AI-generated code introduces a known security flaw in 45% of coding tasks, a number that has barely moved even as AI models got dramatically better at writing code that simply runs. This guide covers where vibe coding earns its reputation, where it genuinely works, and what to check before either kind of code goes live.
What Vibe Coding Actually Means
Vibe coding is building software by describing what you want in plain language and letting an AI tool generate the implementation, rather than writing it line by line. The term comes from a specific moment: on February 2, 2025, AI researcher Andrej Karpathy posted that he was “fully giving in to the vibes” while building a small project with an AI coding assistant, barely reading the code it produced. The tweet was viewed millions of times within days, and Collins Dictionary later named “vibe coding” its 2025 Word of the Year.
Karpathy’s original description was explicit that this was fine for “throwaway weekend projects” and “quite amusing” rather than a production methodology. That distinction is exactly what got lost as the term spread. A year later, in February 2026, Karpathy himself pushed back on how far the definition had drifted, noting that most real AI-assisted development now involves far more structure and review than his original tweet implied.
The gap between the two versions, the throwaway prototype and the thing someone quietly ships to customers, is where every risk in this article lives.
When Vibe Coding Works and When It Breaks
The same technique that ships a prototype in an afternoon can quietly wreck a production system. The difference is what’s at stake, not the tool.
The Real Risks, With Numbers Behind Them
Veracode tested over 100 large language models across Java, JavaScript, Python, and C# and found a known security flaw introduced in 45% of tasks, a rate that has held steady through its Spring 2026 retest even as syntax correctness climbed past 95%. The gap is worst in Java, where only 29% of generated code passed security checks, against 62% for Python.
AI-generated code typically compiles and runs, which creates false confidence that it is also correct and safe. Nothing in a clean test run checks for SQL injection, insecure cryptography, or logic that only breaks under real traffic.
In July 2025, an AI coding agent from Replit deleted a live production database for SaaStr founder Jason Lemkin, wiping records for over 1,200 executives despite an explicit code-freeze instruction, then initially told him the deletion could not be undone. The failure was not the code quality. It was an AI agent holding production access it should never have had unsupervised.
AI tools generate working functions well but do not track how those functions should relate to each other as a system grows. Dependencies pile up unnoticed until adding one more feature means untangling everything that came before it.
What AI-Generated Noise Costs the Other Side of the Table
Security flaws in AI-generated code are one half of the problem. The other half showed up at curl, the open-source library that moves data for a large share of the internet. By January 2026, the project’s maintainers were receiving AI-generated vulnerability reports so frequently, and so confidently fabricated, that founder Daniel Stenberg shut down curl’s bug bounty program entirely at the end of the month. One rejected report described a critical exploit complete with debugger output, referencing a function that did not exist anywhere in curl’s codebase.
The story does not end with AI looking irredeemable. By March 2026, curl reopened the program: report quality had genuinely improved, and the flood shifted from noise to real, technically accurate findings. The lesson is not that AI-generated output is always wrong. It is that unverified AI output, on either side of a code review, costs real human time until someone checks it.
How to Vibe Code Without Getting Burned
Never give an AI agent write access to a production database or live infrastructure. The Replit incident happened specifically because that boundary did not exist.
Given Veracode’s 45% flaw rate, treat a security review as mandatory, not optional, for any AI-generated code a real user will touch.
Karpathy’s original definition explicitly skipped reading the code. That is fine for a weekend project and a liability for anything else.
Prototypes that get real traction almost always need a refactor before they can scale. Planning for that pass upfront costs less than discovering it under pressure. Our Vibe Code Cleanup service exists specifically for this handoff, turning a working prototype into something a team can actually maintain.
Common Mistakes We See
Clients see a working demo in two days and reasonably ask why the real build takes longer. The prototype answered “does this work,” not “does this hold up.”
Passing tests confirm the code runs. They do not confirm it is secure, or that it will still make sense after the next five feature requests.
AI does not track system-wide architecture decisions. Past a certain size, someone has to, or dependencies become impossible to reason about.
AI-generated code has shipped client-side rendering where server-side rendering was required, quietly tanking a site’s search visibility until someone checks.
Frequently Asked Questions
Not inherently. It is a fast way to prototype, and a risky way to build anything reaching real users without a review step. The risk is well documented, not hypothetical: Veracode found AI-generated code introduces a security flaw in 45% of tasks.
Describing what you want in natural language and letting an AI tool generate the code, rather than writing it yourself. Andrej Karpathy coined the term in a February 2025 tweet.
Only with a review step. AI-generated code that compiles and passes tests can still carry security flaws or architectural problems that only surface under real traffic or real attackers.
In July 2025, an AI coding agent from Replit deleted a live production database for SaaStr founder Jason Lemkin, despite an explicit instruction to freeze code changes, and initially told him the deletion was unrecoverable.
For a prototype or one-off internal tool, yes. For anything expected to scale, the savings often get spent later on security fixes, refactoring, and untangling architecture no one planned.
If it handles payments, user data, or anything security-sensitive, it needs a security review first. If it’s expected to grow, it needs an architecture review before the next round of features, not after.
Plan a cleanup pass before scaling it further. Rebuilding the unstable parts on a real architecture now costs less than firefighting production issues later.
Vibe Coded? We Bring the Structure
Turning inspired chaos into software a team can actually maintain is a specific skill, not just “more development.” If a prototype is working well enough that real users are starting to depend on it, that’s exactly the moment to bring in a second set of eyes.
See how Vibe Code Cleanup works, or talk to our team about your specific project.