Seventy-four vulnerabilities. That is the tally researchers at Georgia Tech’s School of Cybersecurity and Privacy arrived at after combing through 43,000 security advisories this past April and tracing the defects straight back to AI-generated code. Fourteen of the 74 were rated critical.
The figure looks modest right up until you consider what it is measured against. Those 43,000 advisories span only a three-month stretch at the beginning of the year. And the researchers reckoned the true count of AI-generated vulnerabilities is probably five to 10 times what they reported, since the only code they could follow was code somebody had actually disclosed as LLM-generated.
Which means the honest framing of the vibe coding debate is neither “it’s fine” nor “it’s a catastrophe.” It is that most of it is invisible.
Where the term came from
Vibe coding is the practice of leaning on a large language model to write part or all of a project’s code. The phrase belongs to Andrej Karpathy, the AI researcher best known for running Tesla’s Autopilot Vision program.
“There’s a new kind of coding I call ‘vibe coding,’ where you fully give in to the vibes, embrace exponentials, and forget that the code even exists,” Karpathy wrote on X in February 2025. “It’s possible because the LLMs (e.g. Cursor Composer w Sonnet) are getting too good.”
The models have only gotten better at writing code in the months since, and vibe coding caught on. Anything that catches on attracts a backlash. That was never really in question.
The case for it is a cat with diabetes
The argument in favor is that LLMs democratize software development, putting app-building within reach of anyone. I have seen this play out firsthand.
A neighbor of mine, a former veterinary tech, vibe coded an app to keep track of her senior cat’s insulin shots. She is not a developer, she was never going to pay one, and the app is sitting there working today.
That is the strongest form of the case, and it holds up. The weakest form is what happens when the identical method gets pushed into production.
The maintenance problem nobody advertises
The standard criticism is that vibe coding yields insecure software. The more pointed objection concerns everything that comes after the code ships.
Lean on it heavily and the codebase becomes harder to maintain, because odds are decent that a vibe coder lacks the coding knowledge to repair an error the LLM cannot repair for them. The model produced it. The model cannot debug it. Where do you go from there?
It is not a wall you run into on the first day. You run into it around month six.
Professionals are doing it anyway
If vibe coding had remained a hobbyist pastime, little of this would carry much weight. It did not remain one.
In a recent survey of 1,100 professional programmers with AI tool experience, 72 percent reported reaching for AI coding tools daily, with roughly 42 percent of their codebase generated or assisted by AI. The same respondents expect AI-written code to account for more than half of their codebase by next year.
Worth a second pass: this is their assessment of their own work, offered in spite of the misgivings they and their colleagues hold.
Two very different things wearing the same name
This is the point where the debate tends to derail. Code an LLM produced from scratch is not the same as code an AI tool helped tidy up and debug. Treat them as one thing and everybody’s argument starts sounding off.
Stack Overflow’s 2025 developer survey found 47.1 percent of respondents using AI tools daily. In that same survey, 72 percent reported that vibe coding played no part in their development workflow. A further 5 percent said it was “emphatically” not how they work.
Those figures have almost certainly moved over the past year. Still, as of mid-2025, the typical professional was turning to AI for autocomplete, code review and thinking out loud about a blocker. Not for surrendering an entire file.
The part that costs someone a career
One of the costs here will never turn up in a vulnerability scan.
A lot of what senior developers now hand off to AI is precisely the work they once handed to junior colleagues. That handoff is how juniors turned into seniors.
Writing code was long one of the few dependable routes a young person had into the middle class. It is not anymore. Companies are bringing on fewer junior coders than at any point before.
So if you are going to vibe code, be clear about which of the two versions you are doing. The insulin tracker is fine. A production service with 42 percent of its lines authored by something that cannot account for them is a wager that you will never have to fix it yourself.