Vibe coding ships fast, but 45% of AI code fails security tests
Vibe coding is the shortcut everyone wanted: describe what you want in plain language, let ChatGPT, Claude, or Gemini write the code, and keep prompting until it works. No programming background required. The term was coined by AI researcher Andrej Karpathy, and the adoption numbers back up the hype.
Who Is Actually Using This
Stack Overflow’s most recent developer survey found that 84% of developers globally used or planned to use AI coding tools in 2025. More telling: roughly 63% of users on vibe coding platforms have no programming background at all. These are people building real products, not just tinkering.
Where It Gets Risky
Software that runs is not the same as software you can trust. Researchers have already found thousands of security flaws and exposed secrets in publicly available AI-generated applications. In one security study, about 45% of AI-generated code samples failed standard security tests.
The failure mode is subtle. An expense-tracking app might open, record purchases, and calculate totals correctly, yet store your financial data in a way that is easy for others to access. The app does exactly what you asked. Your data is still exposed.
There is also a compounding problem. Ask the AI to fix one bug and it can introduce another elsewhere. Without understanding what changed, you are dependent on the same tool to clean up its own mistakes.
The Automation Bias Problem
Researchers have a name for what happens next: automation bias, the tendency to accept outputs from automated systems without adequately checking them. As AI gets better at complex tasks, the pull toward trusting it without verification gets stronger. Code is a high-stakes area for this pattern because mistakes stay hidden until something breaks in production.
The Operator Takeaway
Vibe coding is a legitimate tool for prototypes, personal projects, and internal automation. The line gets crossed when AI-generated code goes into production handling personal data, financial transactions, or business operations without any human review. Apps in those categories still need testing, regardless of who wrote the code.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
