Vibe Coding Has a Security Problem, and Shipping Code You Do Not Understand Is Not a Strategy

There is a version of the AI coding conversation that feels way too casual for what is actually at stake. A prompt goes in. A working app comes out. The demo looks clean. The login page loads. The API responds. The build passes. Everyone moves on. That is exactly where I think the trouble starts. “Vibe coding” has become the catch-all phrase for building software mostly through prompts, iterations, and AI-assisted generation instead of line-by-line engineering. Some of that is genuinely useful. I am not anti-AI, and I do not think serious teams should pretend these tools are going away. But I do think a lot of people are getting dangerously comfortable shipping code they do not really understand, on stacks they did not really design, with security assumptions they never actually validated. That is not innovation. That is borrowed confidence. The scale of adoption is real. Stack Overflow’s 2025 developer survey found that 84% of respondents were using or planning to use AI tools in…