Seventy-four vulnerabilities. That’s what researchers at Georgia Tech’s School of Cybersecurity and Privacy found when they scanned 43,000 security advisories this past April and traced the flaws directly back to AI-generated code. Fourteen of them were critical.
That sounds small until you look at the denominator. Those 43,000 advisories covered a three-month window at the start of the year. And the team estimated the real number of AI-generated vulnerabilities was likely five to 10 times higher, because they could only trace code that someone had properly disclosed as LLM-generated.
So the honest version of the vibe coding argument isn’t that it’s fine or that it’s a disaster. It’s that nobody can see most of it.
Where the term came from
Vibe coding means using a large language model to generate some or all of the code for a project. Andrej Karpathy, an AI researcher best known for leading Tesla’s Autopilot Vision program, coined the phrase.
“There’s a new kind of coding I call ‘vibe coding,’ where you fully give in to the vibes, embrace exponentials, and forget that the code even exists,” Karpathy wrote on X in February 2025. “It’s possible because the LLMs (e.g. Cursor Composer w Sonnet) are getting too good.”
Models have kept improving at generating code since then, and vibe coding got popular. Popularity brings backlash. That part was never in doubt.
The case for it is a cat with diabetes
Supporters say LLMs democratize software development, letting anyone build their own apps. I’ve watched it happen up close.
My neighbor used to work as a veterinary tech. She vibe coded an app to make tracking her senior cat’s insulin shots easier. She isn’t a developer, she wasn’t going to hire one and the app exists now.
That’s the strongest version of the argument, and it’s a real one. The weakest version is the one where the same approach ships into production.
The maintenance problem nobody advertises
Critics say vibe coding produces vulnerable software. The sharper complaint is about what happens after the code ships.
Heavy use makes a codebase harder to maintain, because there’s a good chance a vibe coder doesn’t know enough about coding to fix an error when the LLM can’t fix it for them. The model wrote it. The model can’t debug it. Now what?
That’s a dead end you don’t hit on day one. You hit it in month six.
Professionals are doing it anyway
None of this would matter much if vibe coding stayed a hobbyist thing. It hasn’t.
A recent survey of 1,100 professional programmers who’ve tried AI tools found 72 percent used AI coding tools every day, and roughly 42 percent of their codebase was AI-generated or AI-assisted. That same group predicts AI-generated code will make up more than half of their codebase by next year.
Read that again: they’re saying it about their own work, and they’re saying it despite their own reservations and those of their peers.
Two very different things wearing the same name
Here’s where the argument usually goes sideways. There’s a difference between code an LLM wrote wholesale and code where an AI tool helped with cleanup and debugging. Lumping those together makes both sides sound wrong.
Stack Overflow’s 2025 developer survey put daily AI tool use at 47.1 percent of respondents. In the same survey, 72 percent said vibe coding was not part of their development workflow. Another 5 percent said it was “emphatically” not how they do their job.
Those numbers have likely shifted over the past year. But as of mid-2025, most professionals were using AI for autocomplete, code review and talking through a roadblock. Not for handing over the whole file.
The part that costs someone a career
There’s a cost here that doesn’t show up in any vulnerability scan.
Many of the tasks senior developers now automate with AI are the same tasks they used to hand to junior teammates. That’s how juniors became seniors.
Coding used to be one of the few reliable paths a young person could take into the middle class. That’s no longer true. Companies are hiring fewer junior coders than ever.
If you’re going to vibe code, know which of the two versions you’re doing. The insulin tracker is fine. The production service with 42 percent of its lines written by something that can’t explain them is a bet on never needing to fix it yourself.
