Vibe Coding: What It Gets Right, and Where It Breaks Down
AI can generate impressive code fast. But vibe coding has hard limits that engineering leaders need to understand before going all-in — security, maintainability, and the junior developer trap.
Category: AI & DevOps | 7 min read | Published: 2026-04-01
Vibe coding is real, and the productivity gains it enables are genuine. Engineers using Cursor, Claude, or GPT-4o to generate feature implementations, write tests, scaffold boilerplate, and refactor existing code are routinely delivering 2–5x the output they could produce through traditional character-by-character development. For prototyping, internal tooling, and well-defined feature work in familiar domains, vibe coding is not just acceptable — it's genuinely transformative. Engineering leaders who dismiss it as a toy are missing a real productivity shift.
But vibe coding also has hard limits that are being obscured by the enthusiasm of the early adopter cycle. AI code generators produce confidently incorrect output with a frequency that's high enough to matter for production systems. They have systematic blind spots around security, business context, and long-term maintainability. And they create a specific risk when used by inexperienced engineers without adequate supervision — a risk that's already causing problems at companies that deployed AI coding tools broadly without establishing appropriate guardrails. Understanding the limits isn't a reason to avoid AI coding tools; it's a prerequisite for using them safely.
What Vibe Coding Gets Right
The domains where vibe coding delivers its highest returns are well-defined and worth understanding clearly. Boilerplate generation is the most obvious: CRUD endpoints, database migration files, type definitions, React component scaffolding, test setup — all of this can be generated accurately and quickly by AI tools. The patterns are well-established, the AI has seen millions of examples, and the output is reliable enough for a developer to accept with light review.
Prototyping is another high-value domain. When you're exploring an idea — building a proof-of-concept to validate a technical approach, or generating a first draft of a UI to show a stakeholder — the speed of vibe coding changes the economics of exploration. A prototype that would take 2 days to build manually can be assembled in 3–4 hours using AI tools. The code quality of that prototype doesn't matter much because prototypes are discarded; what matters is that you can explore 5 ideas in the time it previously took to explore 1.
Refactoring assistance is a third high-value domain. AI tools can identify patterns in an existing codebase, suggest refactoring opportunities, and generate refactored versions of complex functions. They're particularly good at extracting reusable utilities from duplicated code — a task that's tedious and error-prone for humans but well-suited to pattern-matching AI. DevStack's DevBoost engineers use AI refactoring tools as a standard part of technical debt reduction engagements, routinely achieving 40–60% faster debt clearance than manual refactoring approaches.
The Hard Limits of AI Code Generation
Understanding where AI coding tools fail systematically is the prerequisite for using them responsibly in a production environment. The failure modes are consistent and well-documented.
Security Vulnerabilities in Generated Code
AI coding tools have a persistent and well-documented tendency to generate code with security vulnerabilities — not because the models are "bad" but because security vulnerabilities often come from subtle interactions between code components that require deep contextual understanding to prevent. According to research published via OWASP and corroborated by GitHub's security research, AI-generated code exhibits elevated rates of OWASP Top 10 vulnerabilities including: SQL injection via unsanitised string concatenation in queries, insecure random number generation in authentication contexts, hard-coded credentials and API keys in configuration files, missing input validation leading to XSS exposure, and insecure direct object references in REST API handlers.
These vulnerabilities are particularly dangerous because AI-generated code looks correct — it compiles, passes basic tests, and implements the described functionality. The security flaw is in the implementation detail, not the structure. Engineers reviewing AI output for functional correctness will often miss a security issue that they would have caught if they'd written the code themselves. The mitigation is mandatory automated security scanning (SAST tools like Semgrep, Snyk, SonarQube) on all AI-generated code, plus security-specific review for any code that handles authentication, authorisation, user data, or financial transactions.
Hallucinated Dependencies and Deprecated APIs
AI coding tools confidently reference packages, APIs, and methods that don't exist, have been removed, or have changed significantly. A model trained on data through early 2024 will generate code using npm packages that were subsequently deprecated or abandoned, API endpoints that have changed between versions, and framework methods that have been renamed or removed. This is the "hallucination" problem applied to code — and it can be subtle enough that the code looks plausible until you try to run it. Research published in ACM's digital library on LLM code generation accuracy found that hallucinated API references are among the most common failure modes in AI-generated code, particularly for less-common libraries and recent framework versions.
Accumulated Complexity and Unmaintainable Patterns
AI coding tools tend to add rather than refactor. When asked to implement a new feature, a tool like Cursor or Claude will typically generate new code that satisfies the requirement — even if the right engineering approach is to refactor existing code to accommodate the feature elegantly. Over time, this leads to codebases that grow in complexity faster than their maintainability warrants: duplicated utility functions, inconsistent patterns across similar features, and modules that have grown beyond reasonable size because each new feature was appended rather than integrated. The result is technical debt that accumulates faster with AI-assisted development than without it, unless engineers actively counteract the tendency by refactoring AI suggestions to match existing patterns.
Missing Business Context and Edge Cases
AI tools don't understand your business. They understand the words in your prompt, the patterns in your codebase, and the training data they've been exposed to. But they can't understand the business rule that was documented in a Confluence page from 2022, the edge case that only occurs for a specific customer segment, or the compliance requirement that your company's lawyers negotiated 18 months ago. Code that handles these requirements correctly needs to be written by engineers who understand the business context — and reviewed by those engineers even when AI generates the initial draft.
How Senior Engineers Actually Use AI Coding Tools Responsibly
The engineers who get the most value from AI coding tools — and the fewest production incidents — treat AI as an accelerator, not an author. They specify intent at a high level, review the generated output critically (not just for whether it runs, but for whether it's correct, secure, and maintainable), refactor AI suggestions to match the team's existing patterns, and treat AI output as a first draft that requires editing. They've developed a mental model of AI's characteristic failure modes — the security patterns it misses, the edge cases it skips, the complexity it accumulates — and they check for those patterns systematically in every review.
The best analogy is a senior architect working with a fast but inexperienced junior engineer. The junior engineer (the AI) can produce a lot of code quickly. The senior engineer's job is to shape that output — catching the mistakes, improving the design, ensuring consistency with the existing system, and maintaining standards that the junior engineer doesn't yet have the judgment to uphold independently. The AI doesn't remove the need for senior engineering judgment; it changes what that judgment is applied to.
The Vibe Coding Talent Trap: When Junior Developers Go Unsupervised
The most dangerous application of vibe coding is junior developers using AI tools without adequate supervision from senior engineers. The pattern goes like this: a junior developer asks an AI tool to generate a feature implementation. The AI generates code that looks professional, compiles, and passes basic tests. The junior developer, lacking the experience to evaluate the code's security posture, architectural soundness, or edge case handling, submits the PR. The PR goes to code review — but if the code reviewer is also using AI-assisted review at a surface level, the subtle issues get missed. The code ships, and the vulnerability or architectural problem is discovered weeks or months later, at much higher cost.
This is not hypothetical — it's the pattern behind a significant number of the security incidents and architectural crises that engineering teams have experienced since AI coding tools became mainstream in 2023–2024. The solution is not to restrict junior developers from AI tools — the productivity benefit is real — but to ensure that all AI-generated code from junior developers gets security review from a senior engineer who understands the characteristic failure modes. DevStack's DevPods+ model includes this guardrail: AI-generated code is reviewed by a Pod Lead who is a senior engineer, not just for functional correctness but for security patterns and maintainability.
What the Right AI-Enhanced Engineering Culture Looks Like
The best AI-enhanced engineering cultures in 2026 share several characteristics. First, they have explicit standards for AI tool usage — which tasks AI is appropriate for (boilerplate, test generation, documentation), which require human-first approaches (security-critical code, core business logic), and what the review standard is for AI-generated output. Second, they invest in security tooling: SAST scanning on all PRs, dependency vulnerability checking, and regular security reviews of AI-generated code in sensitive areas. Third, they maintain senior engineering judgment as the quality gate — AI tools are approved at the PR level by engineers with the experience to catch their failure modes.
DevStack's AI Enablement service helps Australian engineering teams build exactly this culture — not just deploying AI tools, but establishing the standards, training, and review processes that make AI-assisted development safe and sustainable for production systems. The goal is a team that ships faster because of AI tooling, not one that ships faster at the cost of security and quality.
The Measurement Imperative: Knowing What Your AI Tools Are Actually Doing
One of the most underappreciated risks of vibe coding culture is that it can produce teams that feel faster while not actually delivering more — or worse, delivering more code with more hidden quality problems. Velocity measured in story points accepted or features shipped is not a reliable indicator of AI tool impact: AI tools can increase code volume significantly while improving or degrading quality depending entirely on how carefully the generated output is reviewed. The only way to know whether your AI tools are genuinely improving delivery is to measure the right metrics: cycle time, defect escape rate, test coverage trend, and code review quality signals.
The ROI measurement framework for AI coding tools provides a complete methodology for establishing pre-adoption baselines and tracking meaningful improvement over a 90-day experiment. It's designed specifically for engineering leaders who need defensible data — not anecdotal impressions from developers who love the tool — to justify expanding AI tooling investment and to catch cases where the tooling isn't delivering the expected returns.
The interaction between vibe coding practices and technical debt is also worth understanding clearly. AI tools that are used well — with proper review and active refactoring of generated output — reduce mechanical debt (missing tests, undocumented code, copy-pasted patterns). AI tools that are used carelessly — accepting generated code without architectural review — accelerate complexity debt, because AI tends to add code rather than redesign existing patterns. Our guide to reducing technical debt with AI assistance covers the specific practices that preserve code quality while capturing AI's speed benefits — including when to override the AI's suggested approach in favour of consistency with the existing codebase. Both the speed and quality benefits of AI tooling are real; capturing both simultaneously is a matter of deliberate process design.
Want to use AI coding tools without the security risks? DevStack's AI Enablement team helps Australian engineering teams build responsible AI development practices. Contact us to find out more.
Frequently Asked Questions
What is vibe coding?
Vibe coding is the practice of describing software requirements in natural language to an AI coding tool (Cursor, Claude, GPT-4o) and accepting the generated code with minimal manual review — relying on the AI's judgment for implementation decisions. The term, coined by Andrej Karpathy in early 2025, captures the shift from deliberate, character-by-character coding to high-level intent specification. It works remarkably well for prototyping, boilerplate generation, and well-defined feature work. It breaks down in complex, security-sensitive, or highly contextual production environments.
Is AI-generated code production-ready?
Sometimes, with review. AI-generated code is often syntactically correct and functionally plausible, but it regularly produces subtle semantic errors — code that passes basic tests but fails under edge cases, uses deprecated APIs, misunderstands business requirements, or introduces security vulnerabilities that aren't immediately apparent. Production-readiness requires the same review standards as human-written code — arguably stricter, because AI-generated code can be confidently wrong in ways that human-written code rarely is.
What are the biggest risks of using AI to write code without review?
The top risks: (1) Security vulnerabilities — AI tools regularly generate code with OWASP Top 10 patterns including SQL injection, insecure deserialization, and hard-coded credentials. (2) Hallucinated dependencies — packages that don't exist, or exist but have been compromised. (3) Outdated API usage — code that uses deprecated methods or library versions. (4) Missing business context — technically correct code that doesn't match what the product actually needs. (5) Accumulated complexity — AI tends to add code rather than refactor, leading to bloated, hard-to-maintain systems over time.
How do senior engineers use AI coding tools responsibly?
Senior engineers use AI tools as an accelerator, not an author. They specify intent at a high level, review the generated output critically (not just for whether it runs, but for whether it's correct, secure, and maintainable), refactor AI suggestions to match the team's architectural patterns, and treat AI output as a first draft that requires editing — not a finished product. The best AI-enhanced senior engineers have learned to recognise the characteristic failure modes of AI code generation and check for them systematically.
Can vibe coding replace junior developers?
No — but it changes what junior developers need to do. AI tools can generate the boilerplate and routine feature code that previously occupied most of a junior developer's time. But junior developers are also learning engineers — they develop judgment through the practice of writing and reviewing code. A junior developer who uses AI tools without understanding the underlying patterns isn't learning; they're operating AI tools. The risk isn't that AI replaces junior developers; it's that junior developers who rely entirely on AI without developing technical judgment become permanently junior.
What types of code should never be AI-generated without expert review?
Security-critical code (authentication, authorisation, encryption, session management, payment processing) should never be accepted from AI generation without expert security review. Regulatory-compliance code (privacy data handling, financial transaction logic, medical data processing) carries legal liability that requires human accountability. Infrastructure-as-code for production environments needs rigorous review — a misconfigured cloud resource created by AI can expose data or generate significant unexpected costs. Complex business logic with multiple interacting constraints needs a human who understands the full business context.