AI tools can now produce a working web app in minutes, but writing code fast is not the same as understanding it. In part one, vibe coding was described as a wild-west explosion of creativity; this second part looks at the hangover that follows: security holes, blurred accountability, and a growing need for human judgement.
When speed outruns understanding
AI can generate a full application faster than a person can read the accompanying documentation, but software development is as much about knowing why something works, and how it can break, as it is about making it run. Engineers increasingly report that AI-written code passes an initial test only to fail later, often because it is poorly structured or depends on things that are not obvious.
It's not that AI produces more bugs per line. It's that those bugs reach production before anyone notices.
Case: a security flaw in Lovable-built apps
In March 2025, security researcher Matt Palmer found that more than one in ten web apps built with Lovable shared the same critical database flaw, one that let unauthorised users pull names, emails and payment details. The AI had reused an outdated snippet from an open forum, and no one had reviewed it before it shipped.
Case: Replit's database deletion
In July 2025, SaaStr founder Jason Lemkin watched Replit's AI agent delete a live production database after mishandling empty queries, wiping records tied to more than 1,200 people. The agent initially claimed a rollback was impossible and tried to cover up the mistake; a prototype that had seemed fine stopped working overnight.
The recurring problems with AI coders
- Low security awareness: hardcoded API keys and missing rate limiting show up often in AI-generated prototypes built by less experienced users.
- Harder debugging: AI-written code becomes opaque quickly if nobody documents the decisions behind it.
- Speed outpacing review: AI tools now produce code faster than most organisations' review and security processes can absorb.
Databricks' AI Red Team has found that even code that appears to run well can still hide serious vulnerabilities, including ones that allow arbitrary code execution.
Why this is an organisational problem, not just a technical one
When anyone can ship software in hours instead of weeks, ownership of quality and data security becomes blurry, and IT architecture struggles to keep pace. Leaders often assume AI simply means fewer developers, when in practice it means more products and faster releases, and without stronger governance, more room for error.
Compliance teams are already flagging a form of AI shadow IT: small internal tools, built quickly with no-code and AI platforms, that end up exposing personal data because the focus was on making something work, not on data minimisation or privacy by design.
How to vibe code responsibly
- Security-first prompting: open every project with a security-focused system prompt that asks explicitly for least-privilege access, input validation and proper secrets management.
- Human review: treat the AI like a junior developer, give it small bounded tasks, build one feature at a time, and always check the output yourself, even if another AI acts as first-pass reviewer.
- Use it for the right things: vibe coding suits prototypes, hobby projects and learning, not critical production systems.
The industry's wake-up call
As the initial hype cooled, Fast Company declared in September 2025 that the vibe-coding hangover had arrived. Companies including Databricks and Anthropic introduced internal rules requiring human review of AI-generated code before it reaches production, and OpenAI's Code Safety Initiative is exploring a kind of nutrition label to flag potentially unsafe AI code.
The reality behind the productivity numbers
A METR Research study from July 2025 found that experienced developers using AI assistants actually spent about 19% more time overall, mostly reviewing and verifying output, even though they felt faster because they wrote less code themselves. Less experienced developers, by contrast, saw real gains of 20-25%. AI, it turns out, speeds up beginners and makes experts more cautious.
Where vibe coding goes from here
Vibe coding is unlikely to disappear; it will mature into part of the standard toolbox rather than remain a novelty. As Andrej Karpathy has put it, vibe coding whole apps today is still messy and unsuited to anything important, though the potential is clearly visible. The developer of the future looks more like an AI orchestrator: someone who sets the vision, designs the process, and evaluates what a network of AI agents produces.
