In February 2025, artificial intelligence (AI) researcher Andrej Karpathy described a new way of building software: describing what you want to an AI tool, accepting the code it produces, and rarely reading it closely. He called it vibe coding. By November 2025, Collins English Dictionary had named it Word of the Year.
Vibe coding can turn ideas into working prototypes in hours. The risk begins when that code reaches production and no one on the team fully understands how it works. This article explores where that risk comes from and how organizations can keep the speed without losing control.
Why Vibe Coding Creates Hidden Risk
Working code is not the same as well-understood code. AI tools can produce features that pass a quick test while hiding weak error handling, insecure defaults, or dependencies no one chose deliberately. These weaknesses often stay hidden until the system faces real users, real data, or a determined attacker.
Security research shows the scale of the problem. Veracode’s 2025 GenAI Code Security Report tested more than 100 large language models (LLMs) on 80 coding tasks and found that the generated code introduced security vulnerabilities in 45% of cases. The company’s chief technology officer linked the trend to developers relying on AI without explicitly defining security requirements.
Software packages add another risk. AI tools sometimes suggest libraries that do not exist, and attackers can publish malicious packages under those invented names, a tactic known as slopsquatting. Research presented at USENIX Security 2025 found that roughly 20% of sampled AI-generated code referenced packages that do not exist.
The Business Cost of Code Nobody Understands
When a system fails, someone must diagnose and fix it. If the code was accepted without review, the team may need hours to understand logic it never designed, which extends outages and raises support costs. Outages in customer-facing systems also affect revenue and reputation.
The same gap affects every future change. Adding features to poorly understood code is slower and riskier, so short-term speed can turn into long-term technical debt, the future rework created by shortcuts taken today. Teams may also hesitate to change fragile code at all, which slows the business’s response to new requirements.
Accountability also becomes unclear. Customers, auditors, and regulators expect organizations to explain how their systems handle data and make decisions. Pointing to an AI tool is not an acceptable explanation when a security incident or compliance review occurs.
Using AI Coding Tools Responsibly
The goal is not to ban AI coding tools, which can deliver real productivity gains. It is to apply the same discipline to AI-generated code as to any other code. Practical safeguards include:
- Require a developer who understands the change to review and approve all AI-generated code before it is merged
- Run static analysis and dependency scanning on every change to catch insecure patterns and suspicious packages
- Limit vibe coding to prototypes and experiments, and apply full engineering standards before anything reaches production
- Ask developers to explain critical logic in their own words during review, which confirms real understanding
- Track which components were AI-generated so they receive extra attention during audits and testing
These safeguards add some time to each change. That time is usually far smaller than the cost of diagnosing an incident in code no one understands. Many teams also find that review improves their prompts, because developers learn which instructions produce safer code.
Speed With Understanding
Vibe coding shows how quickly AI can turn ideas into software, but speed without understanding creates security gaps, slower fixes, and unclear accountability. Organizations that pair AI tools with code review, automated security checks, and clear standards for production code can move faster without losing control of their systems. Organizations adopting AI-assisted development benefit from working with an experienced software development team that combines AI productivity with disciplined engineering practices.
