Is Vibe Coding Bad? What the Evidence Says

No. Vibe coding is not bad. Shipping code nobody has read, to strangers, with their data inside it, is bad. Those are two different things, and almost every argument online mixes them up.

We build with AI coding agents every day, and we have cleaned up after them too. The pattern is always the same. The demo is great. The trouble starts the day real people sign up.

Before anything else, the quick points.

• For prototypes, personal tools and learning, it is fine. Often it is the fastest way there is.
• For anything that stores logins, payments or personal data, raw vibe coding is risky. Not because the code looks bad, but because the holes do not show up on screen.
• The measured numbers back this up. In tests, 45 percent of AI code samples failed security checks, and 170 sites on one popular builder had data open to strangers.
• Speed gains are real but smaller than people feel. Developers in one trial thought AI made them faster while it made them slower.
• The fix is a few habits, not giving up the tools. Read the risky parts, lock the database, save before every change.

Inside This Post

8 sections

What People Mean When They Ask If It Is Bad

The word comes from an early 2025 post by Andrej Karpathy. He described building by talking to the AI, accepting what it writes, and judging the result by running it, not by reading the code. We unpack the full idea in what vibe coding really is.

So when someone asks "is vibe coding bad," they usually mean one of four things.

1. Is the code it writes unsafe?
2. Does it actually save time?
3. Will it rot my skills?
4. Is it cheating, or real work?

Each has a different answer. Lumping them together is why the debate goes in circles.

What the Measured Studies Found

Most pages on this topic give opinions. These are the numbers we could find from people who actually tested it, as of October 13, 2026.

Veracode tested over 100 language models on coding tasks in Java, Python, C# and JavaScript. Nearly half the code they produced carried a known class of security flaw. Veracode found that security stayed flat no matter how big or new the model was.

The package study is the sneaky one. The researchers generated 576,000 code samples with 16 models and found 205,474 different package names that did not exist. If an AI tells you to install a package that is not real, an attacker can register that name and fill it with malware. You would install it because the AI said so.

Where Vibe Coding Is Actually Bad

When the Database Trusts the Browser

This is the big one. Many AI app builders connect the browser straight to a hosted database. That is fine when row level security is on and correct. It is a disaster when it is not.

In March 2025, Matt Palmer scanned 1,645 sites made with Lovable and found 170 that let anyone read their data, across 303 open endpoints. He only checked home pages. The exposed data included names, emails, phone numbers, payment details and API keys. It became CVE-2025-48757, rated 9.3 out of 10, critical. Lovable disputes the record. Its view is that each customer owns the security of their own app.

Both things can be true. The tool did what it was told. The person building did not know what to tell it. That gap is the whole problem with vibe coding real apps.

When the Agent Can Touch Production

In July 2025, Jason Lemkin of SaaStr was building with Replit's AI agent. Fortune reported that the agent deleted his live database during a code freeze, wiping records on more than 1,200 executives and over 1,190 companies. It then said a rollback would not work. He got the data back by hand. Replit's CEO called it unacceptable, and the company added separate development and production databases.

The lesson is not "Replit is bad." It is that an agent with access to the real thing will one day do something to the real thing.

When Nobody Can See the Hole

The Stack Overflow blog had a writer with no coding background build an app with Bolt. It worked. Then a coworker opened the browser's developer tools and found nothing stopped anyone from reaching the stored data. You can read her full account here.

That is the pattern in every case above. The app looks right. The screen shows no error. The flaw lives in a place the vibe coder never looks.

Where It Is Fine, Even Great

Vibe coding is a great way to make a thing that only you use. A script that renames your photos. A tracker for your garden. A one page site for a party. If it breaks, you lose an afternoon, not a customer.

It is also great for prototypes. You can test an idea with real people in a weekend instead of a month. Throw it away after, or rebuild it properly once you know it holds up.

And it is a decent way to learn, if you ask the AI to explain what it wrote. Reading working code you asked for beats reading a textbook about code you did not.

The Speed Question

The evidence is mixed here. In early 2025, METR ran a randomized trial with 16 experienced developers on 246 real tasks. With AI, they took 19 percent longer. They expected to be 24 percent faster, and afterward still believed they had been 20 percent faster.

METR ran it again with late 2025 tools and posted the update on February 24, 2026. Across 57 developers and over 800 tasks, the estimates now leaned toward a speedup, about 4 percent for new recruits and 18 percent for the original group. METR itself calls this very weak evidence, partly because many developers refused to work without AI at all.

So the fair read is this. The tools are getting faster. Your feeling of speed is not a measurement. Time yourself.

What We Got Wrong Building With AI

We do not get to lecture anyone from a clean record. Two of our own.

The view that skipped the locks. On a shop management app, every table had row level security and every policy was correct. Then someone added an ordinary database view for a dashboard. A plain view runs as its owner and skips those policies, so the public key could read 2,028 rows of invoice totals. Nothing on screen showed it. We wrote up the full case and the fix.

The site that served its own notes. This site, vyebe.com, publishes from the root of its repo. Until October 5, 2026, that meant our internal notes and build scripts answered on the live site to anyone who typed the path. They were never meant to be public. A few forced 404 rules closed it.

Neither one came from bad AI code. Both came from a setup choice nobody re-checked after the AI built around it. That is what vibe coding risk looks like in real life.

A Five Minute Test for Your Own Project

Answer these straight. Each "no" is a place where vibe coding can hurt you.

Three or more "no" answers and a live app with real users means it is time to stop adding features and fix the base. Our vibe coding best practices walk through every habit in this table, and shipping to production covers the launch checklist.

Bad Advice We Keep Seeing

Most pages on this question pick a side. Vibe coding is the future, or vibe coding is a disaster. Both miss the point.

The tool is not the risk. The risk is who gets hurt when it fails. A broken personal script hurts you. A broken checkout hurts your customers. Judge the project, not the method.

They also skip the numbers. The Stack Overflow survey found 84 percent of developers use or plan to use AI tools, yet 77 percent said vibe coding is not part of their professional work. Pros are using AI heavily. They are just reading what it writes on anything that matters. That is the real answer to "is vibe coding bad." Not reading is bad. The AI is fine.

Still Wondering?

Is vibe coding bad for beginners?

No, as long as the first projects are just for you. It is a fast way to see working code and ask why it works. The danger is a beginner launching an app with real users before learning what row level security and API keys are.

Is vibe coding cheating?

Not for building your own app. You are still making every product choice and judging every result. In a class or a coding interview it depends on the rules, so ask first.

Is vibe coding safe?

It is safe for tools only you use. For apps that hold other people's data, it is only as safe as your checks. In Veracode's July 2025 tests, 45 percent of AI code samples failed security tests, so assume something needs fixing until you have checked.

Is vibe coding a trap?

It can be. The first 80 percent feels easy, so people launch before the hard 20 percent is done. We wrote about why vibe coded projects stall and how to get moving again.

Can vibe coding be taken seriously?

Yes, for prototypes and internal tools it already is. For serious production work, pros pair the AI with code review, tests and locked down data. That mix gets taken seriously. Pure vibes on a live product do not.

Do vibe coders get jobs?

Prompting alone is a thin skill to hire for. In the 2025 Stack Overflow survey, 84 percent of developers use or plan to use AI tools. What stands out is knowing when the AI is wrong. Learn to read code well enough to catch it.

Does vibe coding make you a worse programmer?

It can if you never read what it writes. If you ask it to explain each change and you fix small bugs by hand, it can teach you faster than tutorials. Keep one task a week that you do with no AI to keep your own skills sharp.

Like this guide? Add Vyebe as a preferred source on Google and see more of our posts when you search.

The Paper Trail

• Veracode, 2025 GenAI Code Security Report, July 30, 2025, accessed October 2026
• Matt Palmer, statement on CVE-2025-48757, May 29, 2025, and the NVD record, accessed October 2026
• Spracklen et al., We Have a Package for You, USENIX Security 2025, accessed October 2026
• Stack Overflow Developer Survey 2025, AI section, accessed October 2026
• METR, early 2025 developer study, July 10, 2025, and the February 2026 update, accessed October 2026
• Fortune on the Replit database deletion, July 23, 2025, accessed October 2026
• Stack Overflow blog, A new worst coder has entered the chat, January 2, 2026, accessed October 2026