The rise of generative AI and its offshoots has made certain skill-based tasks more “accessible” to the average user. Aside from creative endeavours like image and video creation, the technology offers assistance with coding projects, allowing anyone to develop apps and software without needing a programming background. Vibe coding, as the practice is called, has been gaining prevalence, as evidenced by the slew of Adobe Creative Cloud clones, as well as the recently surfaced TuJu rival.
Like any other AI-assisted activity, the convenience offered by the bots does not come without compromise. So before hopping on the bandwagon, there are a few things to consider.
What Is Vibe Coding?
Much like anything done with AI models these days, vibe coding involves the user describing what they want. Then, the AI generates code based on these instructions, resulting in what should be a functional computer program. After that, the user runs the software to check if it works, providing feedback if necessary. New code is generated with the new directions. This process is repeated ad nauseam until the user is satisfied with the output. Although it can be done using general-purpose models, companies have developed specialised tools for this purpose, such as Cursor and Muse Code.
The term vibe coding was coined by OpenAI co-founder and AI researcher Andrej Karpathy. In an X post, Karpathy described the process as fully giving in to the vibes and forgetting that the code even exists. He went on to note that it’s not really coding, saying “I just see stuff, say stuff, run stuff, and copy paste stuff, and it mostly works.”
Google outlined two types or levels of vibe coding. The first is “pure” vibe coding, where the user hands the wheel to the AI, fully trusting the output to work as intended. Very little, if any, programming is done by a human being. Then there’s the more “practical and professional” approach, where AI tools serve as collaborators. The user still prompts the AI to generate a program, but then reviews, tests, and understands the underlying code. Let’s be honest though. More vibe coders fall in the first category than the second one.
The Allure Of Giving In To The Vibes
The absolute bare minimum prerequisite for vibe coding is the ability to speak a natural language. In comparison, coding the conventional way will require knowledge of at least one programming language. This is because the user will be programming manually line by line. It’s a slower, more deliberate approach, as the developer has to figure out how to implement the desired features. Naturally, this means that the quality of the code is limited by the user’s own capabilities and familiarity with a given language.
So, it’s easy to see how vibe coding can appeal to the layperson. The low entry barrier lets just about anyone create an app in just a fraction of the time a programmer would need to come up with a first draft. And more to the point: there is no need to dedicate the time learning the intricacies and quirks of a programming language. You’re basically outsourcing all the major work to AI, after all.
Just Vibing Is Not Enough
On the surface, vibe coding sounds like an upgrade from traditional programming. You get results quicker without having to contend with pesky technicalities and the frustration of debugging. Passing along an error message to Claude Code is easier than manually combing through hundreds and thousands of lines for a missing semicolon.
But obviously, there are problems with this approach. For starters, the user does not have intimate knowledge of their program. Knowing one’s code inside out is an essential part of being a developer. Simply knowing what the program does is not enough—you need to know what every bit of code is doing and why. This is because programming doesn’t stop at just writing the code and deploying the finished product.
Much like hardware, software needs to be maintained to ensure it keeps functioning as intended. Over time, a program can degrade even when the developer has left it untouched. This is known as software rot, and it can happen due to various factors, such as changes in the program’s environment and bugs in unused code that surface in the future.
Basically, to vibe code is to surrender all control to the AI. The user does not know what functions are within their program, which makes maintaining and updating it more challenging. What’s more, adding new features without breaking existing functionality becomes a problem.
But hey, one may argue that all these things can be outsourced to the AI as well, so there’s no reason to care, right? Except you cannot really guarantee that you’re getting fully functioning code with each prompt. Depending on the scope of the project, the AI may introduce bugs, security issues, and other unintended behaviours. And the more code you generate, the harder it is to keep these things under control.
Generated code tends to be verbose and inconsistent when naming identifiers. Other than that, it can be inefficient and resource intensive. These issues make restructuring and refactoring all the more important, which, sure, you could probably ask the AI to do that too. But refactoring is one of the areas the AI is likely to struggle with. It has trouble recognising problem areas and requires a lot of direction.
A Matter Of Security
Of course, messy, convoluted code has existed for as long as programming has. A good chunk of traditionally-developed software out there is full of spaghetti code and functions developers don’t fully understand, and yet these flaws are allowed to remain. Mostly because detangling the mess can be a labour-intensive process. The main point is, the code itself has undergone rigorous review and is deemed not just functional, but safe.
Hopefully, even the most technologically illiterate vibe coder should recognise that deploying untested software into the wild and presenting it as a working app is incredibly irresponsible at best and downright dangerous at worst. But some may not realise that testing isn’t just a matter of functionality, but also security. AI models tend to focus on the former rather than the latter, since their main goal is to do as they’re told. While human programmers learn to consider security concerns when coding, the AI does not.
Past studies have identified the common mistakes found in AI-generated code, such as hardcoding API keys and other secrets directly into the webpage, making them visible to anyone. Other than that, the program may implement authentication logic completely on the client or user side, where it can be modified.
But beyond these “newbie” errors, there is one particular risk that is unique to code written by AI: slopsquatting. Basically, malicious actors exploit the AI’s tendency to hallucinate. AI-generated code may contain packages or libraries that don’t actually exist, and attackers keep an eye out for these fake packages. They can then register those names on public registries, so when an unsuspecting vibe coder commits or saves the code, they end up unknowingly installing malware instead.
What’s The Takeaway Here?
Vibe coding has proven to be useful for quick prototypes and proof-of-concepts, as well as smaller programs. It’s far less ideal when dealing with sprawling, large-scale projects. And more importantly, your mileage will vary depending on your familiarity with programming. Naturally, experienced programmers will benefit the most from vibe coding, as they can recognise where the AI makes mistakes.
In the best case scenario, vibe coding may inspire people to learn how to program, though it likely won’t teach clean coding practices. But even if you’re less invested in building the skill and just want quick results, there’s no harm in making sure your code passes the vibe check.
