Vibe coding
Building software by prompting an AI and accepting its output largely without reading or understanding the code.
Vibe coding was named by Andrej Karpathy in February 2025 to describe giving in to the AI: describe what you want, run what comes back, paste errors in until it works. It is fast for prototypes and throwaway tools.
The security problem is that nobody reviews what ships. Generated code reproduces common flaws (missing authorisation checks, IDOR, secrets in source, permissive CORS, weak crypto defaults), pulls in packages that may not exist, and gets deployed by people who cannot spot any of it.
The practical answer is not banning it but putting controls where code lands: CI with SAST, SCA and secrets scanning, dependency allow-lists, branch protection and review for anything that touches production, and paved-road templates that make the safe pattern the default the AI copies.