Answers › Technology

What is vibe coding, and is it safe?

Answered by Everyday AI Podcast – An AI and ChatGPT Podcast with Everyday AI · Sep 17, 2026

Vibe coding is when you describe what you want in plain English and let an AI write the software, often without reading the code yourself. It's real, it's growing fast, and according to Jordan Wilson on episode 859 of the Everyday AI Podcast, it's both a genuine breakthrough and a genuine liability. Safe? It can be, if you treat what the AI builds like real engineering. Left unchecked, it produces apps with security holes that nobody on the team understands.

Describe it, and an app appears

Jordan opens with an analogy: imagine describing your dream house out loud and watching a building appear in minutes. That's what vibe coding feels like the first time. You type what you want, and the tool handles the database, the login system, the payments integration and the deployment. A working app, with a live URL, from a paragraph of text.

The numbers he cites show how far this has gone. Somewhere between 41 and 46 percent of new code written worldwide is now AI-generated. Around 92 percent of US developers use AI coding tools daily. And the striking one for non-technical listeners: about 63 percent of people vibe coding have never written a line of code themselves. This isn't a developer trend anymore. It's an everyone trend.

"63% of vibe coders have never even written a line of code themselves, which makes sense given the accessibility."

One in four AI code samples had a security flaw

Here's where the host turns serious. He points to research that examined 534 samples of AI-generated code and found confirmed security flaws in about a quarter of them. That's not a rounding error. If you vibe-code a customer portal and never have anyone look at what's underneath, there's a meaningful chance you've shipped something exploitable.

The problem compounds because trust in AI code is dropping even as usage rises. Jordan cites survey data showing developer confidence in AI-generated code fell from 43 percent to 29 percent over two years. The common complaint is that the output is almost right, which is worse than obviously wrong because it passes a glance and fails under pressure.

And fewer experienced people are doing that glance. The host notes that some prominent developers have said openly that they don't review AI output anymore. The volume of generated code has outrun anyone's ability to read it.

"Out of 534 AI code samples, about 25% had confirmed security flaws. That's a very high percentage."

The 90-day wall

Jordan describes a pattern he calls the 90-day problem. A vibe-coded project launches fast and works. Then, roughly three months in, something needs to change: a new feature, a bug, a scaling issue. The AI session that built the foundation is long gone, its context expired. The humans never understood the architecture because they never had to. Everything stalls.

This has spawned a new line of work he calls rescue engineering: firms that come in to rebuild or untangle AI-generated codebases. He cites an estimate of around 8,000 startups needing full or partial rebuilds, at costs ranging from 50,000 dollars to several million. The speed you gained at the start gets paid back with interest.

"After 90 days, software teams just kind of forget. The AI forgets how it built the foundation. Everything stalls."

How to vibe code without getting burned

None of this is an argument against vibe coding. Jordan is clear that the technology isn't going away and that refusing to use it is its own risk. His argument is about governance, and it comes down to a few practical rules.

Match the tool to the stakes. A personal dashboard, an internal prototype or a throwaway calculator can be vibe-coded freely. Anything that stores customer data, takes payments or faces the public internet needs a human who understands it.

Have someone read the code, or at least test it. Even a non-developer can run a security scanner, ask the AI to explain each part of the app, and ask a second AI to look for vulnerabilities. Treat the output as a draft, not a finished product.

Document as you go. Ask the AI to write down what it built and why, so the next person, or the next AI session, has a map. That's the single cheapest defense against the 90-day wall.

And for organizations, watch for sprawl. Non-technical staff quietly deploying apps that IT has never seen is how a security incident starts. Jordan's closing line is that companies treating AI coding as rigorous engineering with human oversight capture real value. The tech isn't optional. The discipline is a choice.

"Companies treating AI coding as rigorous engineering with human oversight capture real value. This technology isn't optional, but governance is your choice."

People also ask

Can I build a real business app with vibe coding?

You can build a prototype quickly, and many people have. Before it handles real customer data or money, get a developer or a security review involved so you understand what you've deployed.

What's the difference between vibe coding and no-code tools?

No-code tools give you a visual builder with guardrails the vendor maintains. Vibe coding generates actual source code from your description, which is more flexible but leaves you responsible for code you may not understand.

How do I check if AI-generated code is secure?

Ask the AI to explain every component, run an automated security scanner on the project, ask a second model to audit it for vulnerabilities, and have a human developer review anything that touches authentication, payments or personal data.

Based on Everyday AI Podcast episode 859, "The Vibe Coding Boom," released September 10, 2026. Credit to host Jordan Wilson and the Everyday AI Podcast.