Generative AI has made many skill-based tasks far more accessible to people who previously needed specialist knowledge to attempt them. We have already seen this happen with image generation, video creation and writing, but one of the biggest changes is happening in software development. AI coding tools now allow people with little or no programming background to describe an application in everyday language and receive working code in return. This approach, commonly known as vibe coding, has grown rapidly as people use AI to create everything from simple utilities and prototypes to clones of existing applications and even full commercial products.
The appeal is obvious. Instead of spending months learning a programming language, understanding frameworks and debugging code line by line, someone can simply explain what they want and allow an AI model to handle most of the technical work. But the convenience comes with an important trade-off: the less you understand the code being generated, the less control you have over what your application is actually doing. Before handing an entire software project over to AI, there are several risks worth understanding.
What Exactly Is Vibe Coding?
Vibe coding generally involves describing the desired application to an AI model and allowing the system to generate the code needed to build it. The user then runs the program, checks whether it behaves as expected and gives the AI additional instructions whenever something needs to be changed. The model generates another version of the code, the user tests it again and the cycle continues until the application appears to work well enough. The process can be carried out using general-purpose AI models or specialised development tools such as Cursor and other coding assistants designed specifically around AI-generated software.
The term itself was popularised by OpenAI co-founder and AI researcher Andrej Karpathy, who described the experience as essentially giving in to the "vibes" and forgetting that the code underneath the application even exists. Instead of carefully designing the software architecture and manually implementing every function, the user simply sees something they want changed, describes it and lets the AI make the modification. Karpathy even noted that this is not really traditional coding because much of the interaction becomes a cycle of observing, describing, running and copying whatever the AI produces.
There Are Different Levels Of Vibe Coding
Google has described two broad approaches to vibe coding. The first is what could be considered pure vibe coding, where the user gives almost complete control to the AI and trusts that the generated code works as intended. Very little manual programming takes place, and the person building the app may not understand the underlying implementation at all. The second approach is more professional, with AI acting as a development assistant while an experienced programmer still reviews, tests and understands what the system generates.
The second model is much safer because the human remains responsible for the architecture and quality of the application. AI accelerates the work, but it does not replace technical judgement. The problem is that the lowest barrier to entry naturally attracts users who fall into the first category, meaning many people may be creating software without having the knowledge required to evaluate what the AI is giving them.
The Appeal Is Easy To Understand
Traditional programming requires patience and technical knowledge. A developer needs to understand at least one programming language, learn how applications are structured and know how to turn an idea into working logic. Even relatively simple features can require research, testing and debugging before they behave correctly. For someone with no programming background, this creates a significant barrier before they can turn an idea into a functioning application.
Vibe coding removes much of that barrier because the minimum requirement is essentially the ability to describe what you want in natural language. Someone can ask the AI to create a login page, database interface or complete application without manually writing every line of code. This allows ideas to become prototypes dramatically faster and gives people who would never normally attempt programming an opportunity to create software.
AI Can Produce A Prototype In A Fraction Of The Time
One of vibe coding's strongest advantages is speed. A programmer may spend hours setting up a project, selecting frameworks and building the initial application structure before the software does anything visible. An AI coding assistant can often generate a working first version within minutes.
This is extremely useful when the objective is simply to test whether an idea makes sense. Startups, designers and developers can create proof-of-concept applications quickly without investing heavily in something that may ultimately be abandoned. In this context, AI coding can be genuinely transformative because the prototype does not necessarily need production-level quality.
The Problem Starts When A Prototype Becomes A Product
The danger appears when software generated for experimentation is suddenly treated as finished production software. A prototype may work perfectly during a quick demonstration but contain architectural problems, inefficient code or security weaknesses that only become obvious later. Once customers begin depending on the application, fixing those problems becomes considerably harder.
Software development does not end when the application runs successfully for the first time. Applications need maintenance, security updates, new features and compatibility changes throughout their lifecycle. If nobody properly understands how the software was built, every future change becomes another exercise in asking the AI to modify something nobody has fully inspected.
Knowing What The App Does Is Not Enough
A developer needs to understand not only what an application does but also how and why it does it. That knowledge becomes essential when something breaks unexpectedly or when a new feature needs to interact with existing functionality. Without understanding the underlying architecture, even a seemingly small modification can create side effects elsewhere in the program.
Pure vibe coding effectively gives this knowledge to the AI rather than the person responsible for the application. The user sees the visible result but may have no idea which functions, libraries or design patterns are running underneath. This becomes increasingly dangerous as the project grows because the application gradually turns into a system that nobody except the AI appears to understand.
Maintenance Becomes Much More Difficult
Applications rarely remain unchanged after launch. Customers request new features, operating systems receive updates and external services modify their APIs. Developers need to adapt the code continuously while ensuring existing functionality continues working.
If the original creator does not understand the codebase, every maintenance task depends on the AI correctly interpreting its own previous output. The model may change one component without recognising how another part depends on it. As the project becomes larger and more complicated, the chance of unintended consequences naturally increases.
Adding Features Can Break Existing Functionality
This is one of the most frustrating aspects of AI-generated development. You may ask the model to add one small feature and discover that something unrelated suddenly stops working. The AI then fixes that problem but introduces another issue somewhere else.
Developers normally manage this through structured architecture, automated tests and careful review. Pure vibe coding often skips much of that discipline because the focus remains on whether the latest visible feature works. Over time, the codebase can become increasingly fragile.
AI-Generated Code Can Be Verbose And Inconsistent
AI coding tools frequently generate more code than necessary. Functions may be duplicated, variable naming may change between files and several different approaches may be used to solve similar problems. The application can still work, but the internal structure becomes unnecessarily complicated.
This makes future development harder because someone eventually needs to understand why several different patterns exist inside the same project. Code that initially looked impressive because it was generated quickly can become technical debt almost immediately. The faster the AI generates new code, the faster that debt can accumulate if nobody is cleaning it up.
Efficiency Can Also Become A Problem
Generated code may solve the requested problem without considering whether the solution is efficient. A function that works perfectly with ten records may become painfully slow with ten thousand. The AI's priority is usually satisfying the prompt rather than designing for every future performance requirement.
Experienced developers naturally think about database queries, memory usage, caching and scalability when designing applications. A beginner using vibe coding may not even know those concerns exist until the system becomes slow or expensive to operate. By then, fixing the architecture can require substantial restructuring.
Refactoring Is Not Always AI's Strongest Area
Refactoring means reorganising existing code without changing what the application does. It is essential for keeping large projects clean and maintainable as they evolve. Humans perform refactoring by recognising duplicated logic, poor abstractions and architectural weaknesses that may have accumulated over time.
AI can certainly help, but large-scale refactoring requires substantial context and judgement. The model needs to understand how several components interact before safely restructuring them. If the user does not understand the project well enough to guide the AI, it becomes difficult to know whether the refactoring genuinely improved the code or simply rearranged the mess.
Security Is Where Things Become Much More Serious
Messy code is inconvenient, but insecure code can become dangerous. An application can appear completely functional while quietly exposing passwords, API keys or customer information behind the scenes. Users may never realise anything is wrong until someone discovers and exploits the weakness.
This is why testing cannot focus exclusively on whether the application works. Developers also need to ask whether the application can be abused. AI models are generally optimised to satisfy the request they receive, meaning security may not automatically become a priority unless the user understands enough to ask the right questions.
AI Can Make Beginner Security Mistakes
Security researchers have repeatedly identified simple but serious mistakes in AI-generated software. One common example involves placing API keys or other secrets directly inside client-side code. The application may work perfectly, but anyone visiting the webpage can inspect the code and obtain the supposedly private credentials.
Another common mistake involves implementing important authentication checks entirely in the browser. Anything running on the user's device can potentially be modified, meaning an attacker may simply bypass those checks. An experienced developer should recognise these problems immediately, but someone relying entirely on vibe coding may never notice them.
Authentication Should Never Depend Entirely On The Client
Suppose an AI-generated application decides whether someone is an administrator by storing a value in the browser and checking it before displaying an admin page. Visually, everything may appear correct because ordinary users never see the restricted interface. However, someone who understands browser developer tools may simply modify the value and gain access.
Real authentication and authorisation need to be enforced on trusted server-side systems. This is basic security architecture, but a non-programmer may not know enough to challenge the AI when it produces a shortcut. The application works during testing, so the user assumes everything is fine.
AI May Also Use Outdated Or Vulnerable Dependencies
Modern applications rely heavily on third-party packages and libraries. AI models may recommend dependencies based on patterns they encountered during training, but those packages may have become outdated or contain known vulnerabilities. A developer should verify the package, its maintenance status and whether security advisories exist before including it in production software.
A pure vibe coder may simply accept whatever package the AI suggests. If the application runs successfully, there may seem to be no reason to investigate further. This creates another path where convenience can quietly introduce security risks.
Slopsquatting Creates A Risk Unique To AI Coding
One particularly interesting problem associated with AI-generated code is known as slopsquatting. AI models sometimes hallucinate package names that sound believable but do not actually exist. The generated code then attempts to import or install these fictional dependencies.
Attackers can monitor commonly hallucinated package names and register them on public package repositories. When an unsuspecting developer later installs the package suggested by the AI, they may unknowingly download the attacker's malicious software. What initially looked like an innocent AI mistake therefore becomes a supply-chain attack.
The Package Name Can Look Completely Legitimate
This attack works particularly well because hallucinated package names often sound exactly like something a legitimate developer might create. A user has little reason to become suspicious when the AI confidently tells them to install a dependency matching the application's purpose. The command succeeds because the attacker has already registered the name.
An experienced programmer might investigate the package first, checking who maintains it and how widely it is used. A beginner focused entirely on getting the app working may simply follow the AI-generated installation instructions. That difference in behaviour can determine whether malware enters the project.
Functional Testing Is Not Security Testing
One of the biggest misconceptions in vibe coding is assuming that software is safe because every feature works. You can register an account, log in, save data and complete every visible workflow while serious security vulnerabilities remain underneath. Functional testing only confirms that the expected user path works.
Security testing asks entirely different questions. Can someone access another user's data? What happens if input contains malicious commands? Are passwords stored securely? Can an attacker bypass authentication? Those questions require deliberately trying to make the application fail in ways ordinary users would never attempt.
AI Can Help With Security Testing, But It Does Not Replace Expertise
AI coding assistants can generate unit tests, suggest security improvements and identify obvious vulnerabilities. These capabilities can be extremely useful when an experienced developer knows how to interpret the results. The problem appears when the same AI that wrote the application is effectively trusted to declare its own work safe.
Independent review remains important. Someone who understands application security should examine important production systems, particularly when they process customer data, payments or authentication. AI can accelerate that review, but it should not become the only reviewer.
Traditional Code Can Be Bad Too
None of this means manually written code is automatically clean or secure. Developers have been creating spaghetti code, vulnerabilities and poorly documented applications since long before generative AI existed. Large production systems frequently contain functions nobody wants to touch because the original developer left years ago.
The difference is not that humans always produce good code while AI produces bad code. The real difference is accountability and understanding. A competent development process requires someone capable of evaluating the code regardless of who or what generated it.
Code Review Is What Makes The Difference
Professionally developed software normally goes through review before being deployed. Another developer may inspect the changes, automated tests are executed and security scanning tools examine the project for known problems. Larger organisations may also perform penetration testing or additional quality assurance.
Vibe coding becomes dangerous when users skip all of these steps because the application appears to work. Generating the code quickly does not remove the need for reviewing it. If anything, the speed at which AI can create enormous amounts of code makes systematic review even more important.
Small Projects Are Where Vibe Coding Makes The Most Sense
Vibe coding can be extremely useful for small utilities, personal projects and disposable prototypes. If you need a script to rename files or a small internal tool that processes non-sensitive data, asking AI to build it can save enormous amounts of time. The consequences of failure are relatively limited, making experimentation far less risky.
These projects are also small enough that someone can realistically review the complete code if necessary. Problems become much harder once the project grows into hundreds of files, several databases and multiple external integrations. At that point, understanding the architecture becomes far more important.
Proof-Of-Concept Development Is Another Great Use Case
AI is particularly useful when testing whether an idea is technically possible. Instead of spending several days building a prototype manually, developers can have AI assemble something quickly and evaluate the concept. If the idea proves useful, the prototype can then be reviewed, redesigned or rebuilt properly before entering production.
This separates experimentation from production engineering. The AI helps answer "Can we build this?" without automatically assuming the generated implementation should become the final product. That distinction can preserve much of vibe coding's speed while avoiding many of its risks.
Experienced Developers Benefit More From AI Coding
Ironically, people who already know how to program may gain the greatest benefit from vibe coding. They can recognise when the AI has generated something suspicious, understand error messages and evaluate whether the architecture makes sense. Instead of blindly trusting the model, they treat it like an extremely fast junior developer whose work still requires supervision.
The experienced programmer can also provide much more precise prompts because they understand technical terminology. Rather than asking the AI to "make login secure," they can specify authentication architecture, validation requirements and server-side controls. Better instructions generally produce better results.
Beginners May Not Know What They Need To Ask
The biggest disadvantage for non-programmers is that they do not know what they do not know. Someone may successfully generate an entire application without realising they should ask about database indexing, session security, input sanitisation or backup strategies. The absence of visible problems creates confidence even when serious weaknesses remain underneath.
AI cannot reliably compensate for every missing piece of knowledge because it responds to the context and questions provided. If nobody asks whether the system is designed safely, the conversation may remain focused entirely on adding more features. This is how an impressive prototype can slowly evolve into a risky production application.
AI Can Create The Illusion Of Expertise
One of generative AI's most powerful qualities is how confidently it can produce sophisticated-looking results. A complete application with polished screens and functioning buttons can make the creator feel as though they have successfully become a software developer overnight. That sense of achievement is understandable, but it can also hide how much knowledge is required behind the scenes to operate software responsibly.
Building something that runs is only one part of software engineering. Maintaining, securing and scaling it are entirely different skills. AI lowers the barrier to the first part without automatically teaching the rest.
Large Projects Need Architecture
As an application grows, individual coding tasks become less important than how everything fits together. Developers need to decide how data flows through the system, which components own particular responsibilities and how future features can be added without creating chaos. These decisions form the software architecture.
AI can suggest architecture, but somebody still needs to understand whether those recommendations make sense for the project. Without that oversight, the application may gradually accumulate several incompatible patterns simply because the AI solved each new prompt independently. Eventually, no one understands the system as a whole.
Technical Debt Can Accumulate Extremely Quickly
AI coding allows developers to produce code faster than ever, which also means it can produce technical debt faster than ever. Every shortcut, duplicated function and questionable dependency can become another problem future developers need to address. The application may still work today, making it tempting to ignore those issues.
Eventually, however, development slows because every new feature touches fragile or confusing parts of the system. The time initially saved through rapid generation is then spent trying to understand and repair the accumulated complexity. Speed at the beginning does not automatically mean speed across the entire lifetime of the project.
Vibe Coding Could Still Encourage People To Learn Programming
There is also a more positive possibility. Someone may begin using AI simply because they want an application without learning how to code, but curiosity can eventually lead them towards understanding what the AI is generating. Error messages, debugging and modifications naturally expose users to programming concepts over time.
AI can then become an interactive teacher rather than simply a code generator. Users can ask why a particular function exists, how authentication works or why one implementation is safer than another. In this way, vibe coding could become a gateway into learning development rather than a permanent replacement for it.
Learning From AI Still Requires Healthy Skepticism
The important thing is remembering that the AI can be wrong. Explanations may sound convincing while containing mistakes, and generated examples may promote poor coding practices. Beginners should therefore use documentation and trusted educational material alongside AI rather than treating the model as an unquestionable authority.
Programming involves developing the ability to reason about systems rather than memorising syntax. AI can help explain concepts, but users still need to understand enough to challenge incorrect output. That critical thinking becomes especially important when software is intended for real customers.
There Is Nothing Wrong With Using AI To Code
The takeaway is not that developers should avoid AI coding tools. They can significantly accelerate repetitive work, generate boilerplate, explain unfamiliar libraries and help identify bugs. Used responsibly, they are among the most useful development tools introduced in years.
The problem arises when convenience becomes blind trust. The AI should assist the development process rather than becoming the only entity that understands the application. Someone still needs to take responsibility for what reaches production.
Use AI As A Collaborator Rather Than An Autonomous Developer
The safer approach resembles Google's more professional definition of vibe coding. Let AI generate code, but read it, test it and understand what it is doing before accepting the changes. Ask why the model chose a particular implementation and challenge it when something looks unnecessarily complicated.
Automated tests should accompany important functionality, while security-sensitive features deserve additional review. The goal is not to manually write every character simply for the sake of tradition. It is to maintain enough understanding that the human remains in control of the software.
Make Sure Production Code Passes More Than The Vibe Check
Before launching an AI-generated application publicly, developers should evaluate much more than whether the interface works. Authentication, permissions, input validation, secret management, dependencies, backups and error handling all deserve attention. Any feature handling payments or personal information should receive even more scrutiny.
If the creator cannot evaluate these areas personally, someone qualified should review the project before real users begin depending on it. Paying for a professional code or security review may be considerably cheaper than responding to a breach after launch. AI can make application development accessible, but accessibility does not remove responsibility.
Final Thoughts
Vibe coding has opened software development to people who may never have considered building an application before. With little more than an idea and the ability to describe it, users can now create functioning prototypes in a fraction of the time traditional programming would require. That is an impressive development and one that could encourage enormous amounts of experimentation and creativity.
The problem is assuming that generating working software is the same thing as engineering reliable software. AI-generated code can become verbose, inconsistent and difficult to maintain, while security mistakes such as exposed API keys, weak client-side authentication and unsafe dependencies may remain invisible to someone without programming experience. AI also introduces unusual risks such as slopsquatting, where hallucinated package names can be registered by attackers and turned into malware delivery mechanisms.
For small tools, prototypes and proof-of-concept projects, vibe coding can be extremely effective. For large applications handling sensitive information or serving real customers, blindly trusting AI-generated code becomes much harder to justify.
Experienced developers will probably gain the greatest advantage because they can combine AI's speed with their own ability to recognise mistakes. Beginners can still use the technology successfully, but they should view generated code as something that needs to be understood and reviewed rather than magic that happens behind the screen.
There is nothing wrong with letting AI help code your app. The bad idea is letting AI become the only one who understands how your app actually works.
Comments 0