Vibe Coding, and What It Actually Costs

Vibe coding is describing what you want in plain language and accepting whatever the model produces, without reading it closely. You prompt, it generates, you run it, and if it works you move on. The name is honest about the method: you are going on vibes rather than on review.

It is genuinely fast, and it is fast for a specific reason worth being clear about. It skips review, tests, documentation, and structure. Those are not overheads bolted onto software development; they are the parts that make software hold up. Skipping them gets you to a working demo quickly by not doing the work that makes it reliable.

That is a fine trade for a prototype you intend to throw away. It is a bad trade for anything that will run a business process, and the distinction matters more than the technique.

The industry now has enough production exposure to measure this rather than argue about it. The Cortex 2026 benchmark found pull requests per author growing about 20 percent per year while change failure rates grew about 30 percent per year. Velocity went up, and the rate at which changes break things went up faster.

Security is where it gets harder to wave away. Roughly 45 percent of AI-generated code fails OWASP Top-10 benchmarks, with unvalidated inputs, exposed credentials, missing access controls, and broken authentication all common. Code with AI as a co-author has been measured at 1.7 times more major issues and 2.74 times more security vulnerabilities. Cross-site scripting protection fails about 86 percent of the time. In March 2026 alone, 35 new CVEs were attributed directly to AI-generated code.

None of that means models write bad code. It means models write plausible code, and plausible is not the same as correct. A generated function that looks right and handles the happy path will pass a glance and fail on the input nobody thought about.

The useful distinction that emerged this year is between vibe coding and agentic coding, and the difference is not how much AI is involved. Both use a lot.

Vibe coding is fast because it skips the work. Agentic coding is fast because it automates the work while still doing it: tests get written, code gets reviewed, documentation gets generated. Same speed benefit, without removing the parts that catch mistakes. Serious teams have been moving from the first to the second.

The teams most exposed right now are the ones that took the speed and left the review discipline behind. That is a process choice, not a tooling problem, and no model release will fix it.

We use AI heavily to write code and we do not ship code nobody has read. Generated code goes through the same review as anything else, and the review is doing real work rather than rubber-stamping. On a client system that runs a process end to end, a subtle authorization bug is not a bug, it is an incident.

The practical rule we hold to: the faster the code was to produce, the more carefully it needs reading. Speed of generation tells you nothing about correctness, and it is easy to mistake the feeling of progress for progress.

If you are having software built for you, the question worth asking is not whether AI was involved. It almost certainly was, everywhere, and that is fine. The question is what happened between generation and production.