What Vibe Coding Actually Is
Last February, Andrej Karpathy described a pattern he was seeing in the wild. Developers were treating AI code generation like a conversation rather than a deliberate engineering process. You ask the tool to write something. It generates output. You accept it without really reading it. Maybe you test it once. Then you ship it. Karpathy called this “vibe coding,” and the term stuck because it captures something real about how people use these tools today.
This isn’t theoretical. By mid-2025, Cursor, an AI-first IDE built on VS Code, hit 500,000 active developers. That’s not a niche anymore. Cursor raised a $900 million Series B at a $9 billion valuation. The infrastructure exists now. The workflow is optimized for this. You can generate entire features without leaving your editor. The tools are fast, polished, and frictionless enough that treating code generation like casual conversation feels completely natural.
The problem is that natural doesn’t mean safe. And that’s where the backlash becomes justified.
The Data Tells a Specific Story
I don’t trust opinions much anymore. I want data. So let’s look at what researchers actually found. GitClear analyzed 153 million lines of code in 2025 and compared AI-assisted codebases to baselines from 2022. The finding was stark: AI-assisted code showed a 41% increase in churn, code that gets written and then deleted or reverted within two weeks. That’s not a small margin of error. That’s a pattern.
Churn code matters because it signals waste. Waste of engineering time, review cycles, CI/CD resources. More importantly, it suggests that code is being generated without sufficient forethought. A developer who spends five minutes thinking before writing code produces less churn than a developer who prompts an AI to generate five different approaches and then picks one based on gut feeling. The GitClear 2025 AI code quality research shows this empirically.
But churn is just one metric. Security is another. And it’s worse.
Security Is Where Vibe Coding Breaks Down
The U.S. government doesn’t usually jump into technology debates. But CISA did with their 2025 Secure by Design report. They specifically called out LLM-generated code as a growing attack surface. This isn’t hand-wringing. It’s measured language from a cybersecurity agency saying AI tools are reproducing known vulnerable patterns at measurable rates. SQL injection. Cross-site scripting. The classics. The patterns that should be extinct by now.
Here’s where vibe coding becomes dangerous. A developer who reads every line of generated code would catch these patterns because they’ve seen them before. A developer who accepts generated code without reading it won’t catch them until they’re in production. And sometimes not even then. CISA Secure by Design initiative documents this explicitly. The vulnerabilities are real. The reproduction rates are measurable.
The Netlify 2025 State of Web Development report found that 67% of frontend developers used AI to generate entire components. Two out of three developers. But only 23% of those developers reported consistently reviewing generated code for security before deployment. Do the math. That’s roughly 50% of frontend developers shipping AI-generated code with minimal security review. That’s not a backlash waiting to happen. That’s a vulnerability cascade that’s already happening.
Why the Backlash Is Justified
Let me be direct. The backlash isn’t about AI being bad. It’s about workflow culture being misaligned with risk. When tools are frictionless enough, people stop treating code like code. They treat it like suggestions from a smart friend. Suggestions feel disposable. Code isn’t disposable.
I’ve built systems that run for years. I’ve also built systems that collapsed because someone took a shortcut. The shortcut never felt like a shortcut at the time. It felt pragmatic. It felt like moving fast. Then something broke and suddenly that saved time became lost time, multiplied by the cost of firefighting and reputation damage.
Vibe coding accelerates the broken-ness timeline. Not always. Not catastrophically in every case. But statistically, measurably, the data shows increased churn, increased vulnerability reproduction, and decreased security review. That’s not a risk worth taking casually.
What Actually Works
The answer isn’t to reject AI tools. Cursor, Copilot, and similar platforms are genuinely useful when used deliberately. The answer is to restore intentionality to the process. That means reading what gets generated. It means understanding why a particular approach was chosen. It means thinking before you prompt and thinking after you receive output.
For frontend developers and full-stack engineers, that means code review becomes non-negotiable. For security-critical paths, that means running generated code through threat modeling before deployment. For teams, that means talking about what vibe coding looks like in your context and establishing guardrails that actually reflect your risk profile.
Senior engineers have one job in this moment. We need to mentor the people coming behind us toward wisdom instead of speed. That’s not gatekeeping. That’s the responsibility that comes with experience. The backlash is justified. But so is the opportunity to build something better.
What’s your experience been? Have you seen vibe coding patterns in your codebase? I’d genuinely like to hear where the data matches your day-to-day reality and where it diverges.