Blog · Ossci Science

Vibe coding: everyone can “code” now. That’s exactly the problem.

A blog post about AI-generated code, the illusion of control, and why you may build your own gas installation but not your production software.

Ossci Science · October 21, 2026

The doctor and the 30 minutes

In late March 2026, Swiss engineer Tobias Brunner published the story of a doctor who used an AI tool to build a web app for managing his patients. A fine idea — he imported real medical records and put the app online. Within half an hour, Brunner had full read and write access to every patient record. The app was also sending audio recordings of consultations to two American AI services, without a data processing agreement and without the consent of a single patient — a likely violation of Switzerland’s nFADP and other legislation.[1][2]

The doctor meant no harm. He simply had no idea what was happening under the hood. And that is not an edge case — it is the core of a new category of risk called “vibe coding”.

What is vibe coding?

The term was coined on February 2, 2025 by Andrej Karpathy, co-founder of OpenAI: a way of programming where you “fully give in to the vibes, embrace exponentials, and forget that the code even exists”.[3] You describe what you want in plain language, the AI generates the code, and you barely look at what it actually says. In 2025, “vibe coding” was even named Collins Word of the Year.[4]

Important: this is not the same as a professional using AI as a kind of fast typing assistant. Software developer Simon Willison, one of the sharpest commentators in this space, draws the distinction clearly: anyone who reviews, tests and understands every generated line is not vibe coding.[5] Vibe coding, in his words, is “irresponsibly building software through dice rolls, not caring what code is produced”.[6]

The numbers don’t lie

The problem is not that AI writes bad code. The problem is that the code looks good — and that the flaws bite at the exact moment nobody can judge what is happening anymore. The research numbers are, to put it mildly, concerning:

• Veracode tested more than 100 AI models for security: only 55% of the generated code was safe. In the 2026 measurement this has barely improved (56%) — newer models write more fluently, not more safely.[7][8]
• The Cloud Security Alliance found design flaws or known vulnerabilities in 62% of AI-generated code, even with the latest models.[9]
• Germany’s Federal Office for Information Security (BSI), together with France’s ANSSI, concluded that AI assistants without oversight from experienced developers frequently produce incorrect and insecure solutions: known exploits were possible on more than half of the correct programs, and anyone who leans too heavily on these tools eventually loses the ability to judge the code themselves.[10]
• A large-scale analysis of 7,703 public GitHub files found 4,241 known vulnerabilities; Python code scored worst, with 16 to 18.5% of files vulnerable.[11]

There is also a painful perception problem. A randomized study by METR showed that experienced developers felt about 20% faster with AI tools — while objectively measured, they were 19% slower.[12] The feeling of progress and reality can be exact opposites. For someone who already cannot judge what is happening, that is a permanent blind spot.

This isn’t theory: it’s happening now

Replit, July 2025. SaaStr founder Jason Lemkin publicly tested Replit’s AI agent. During an explicit “code freeze” — the instruction-level equivalent of “change nothing” — the agent executed destructive commands against a live production database. Data on more than 1,200 executives and 1,190 companies: gone. The agent then claimed a rollback was impossible (untrue — Lemkin recovered the data manually) and filled the empty database with over 4,000 fabricated users.[13]

Red Access, May 2026. The Israeli security firm scanned roughly 380,000 publicly accessible apps and assets built with vibe coding platforms such as Lovable, Base44, Replit and Netlify. More than 5,000 of them were leaking sensitive data at the time of scanning: medical records, banking details, customer conversations, internal strategy documents.[14]

Football Australia left its AWS access keys exposed in its source code for more than 700 days — nearly two years. GitGuardian found that almost 70% of credentials exposed and validated in 2022 were still active in January 2025.[15][16] According to Gartner researcher Pete Shoard, “the number one risk at the minute” is hardcoded secrets being pushed to GitHub through vibe-coded applications.[17]

The common thread: authorization that exists only in the frontend, databases open to the internet, keys visible in the browser. Everything works for the user. And for the first attacker who comes along.

You can buy anything. So you can do anything?

Here is the analogy that sharpens all of this. You can buy an angle grinder, copper pipes and a gas cylinder at the hardware store. You can even follow a tutorial. That does not mean you are allowed to modify your own gas installation or fuse box — in the Netherlands, doing so without certification is simply prohibited. Not because the government distrusts your creativity, but because you cannot oversee the risks and the damage does not stay with you: your neighbors sleep next to your pipework.

Vibe coding has no certification requirement. On the contrary: the live application becomes the testing ground for its own security. Where the gas fitter must earn a certificate before a single cubic meter of gas flows through their work, vibe-coded code goes straight to production, with customer data in it.

Think the analogy through in other domains:

• Removing your own appendix via YouTube. You can buy a scalpel and follow a surgical video. The difficulty of surgery is not in the act, but in recognizing the moment when things go wrong. A line like eval(user_input) — one short little line that opens a door to the entire server — is invisible to you if you don’t know what you should be looking for.
• Tearing down a load-bearing wall with an angle grinder. The house keeps standing, for days, for months. Until someone puts a piano on it. Bad code “works” too; the damage only appears with real users and real attackers.
• Flying on autopilot without a license. The autopilot can do everything, until something unexpected happens and you have to intervene without being able to read the instruments. The Replit database is exactly that moment.
• Home-distilled liquor at a party. If you distill it yourself, maybe you drink it yourself — but the moment you serve it to your guests, you make it everyone else’s problem. Vibe coding is never just your own risk. It is the 1,200 executives whose data vanished, the patients of that Swiss doctor, the users who never asked for that app.

All four share the same structure: purchasing power is not competence, and competence is not responsibility. Whoever cannot judge the result cannot bear responsibility for it either — while that responsibility does land somewhere. With the doctor, in the form of a GDPR notification and disciplinary complaints. With the company, in the form of a data breach. With the customer, in the form of stolen identity data.

Why this is irresponsible

Until AI can bear legal liability, it stays with humans. So the question is not whether you are allowed to use vibe coding, but whether you can make good on the claim that the result is safe. Anyone who cannot read code can only answer that question with “trust” — and trust is not a security strategy, it is a gamble with someone else’s chips.

That applies doubly once third-party data is involved, because then the pipework is no longer yours alone. Then you are building a wall that other people lean against.

Follow the money: the industry cannot afford for you to think

There is one more reason to stay critical, and it is in the annual reports. The AI sector is in the largest investment cycle in economic history. Microsoft, Alphabet, Amazon, Meta and Oracle set aside a combined $660 to $690 billion in capital expenditure for 2026 in early 2026 — nearly double 2025. Amazon alone around $200 billion, Alphabet $175 to $185 billion, Microsoft more than $120 billion.[18] More recent estimates run even higher. Chipmaker Nvidia posted record revenue of $215.9 billion in its fiscal 2026 — 65% more than a year earlier, driven largely by data centers.[19]

And what do the AI labs themselves earn? OpenAI reportedly booked around $13 billion in revenue in 2025 — against a net loss of nearly $38.5 billion, according to audited documents disclosed by blogger Ed Zitron and verified by the Financial Times.[20] Anthropic: $4.6 billion in revenue against a net loss of $42 billion — of which roughly $34 billion was a non-cash accounting charge related to financing instruments; operating losses excluding those write-downs were around $8 billion — plus $518 billion in infrastructure commitments for the coming years.[21] These are companies burning billions per month, with shareholders expecting it to be earned back eventually. OpenAI has to justify an $852 billion valuation ahead of an expected IPO;[23] Anthropic’s IPO documentation even aimed at a valuation of over $2 trillion.[22] Growth in usage is not a pleasant side effect for them — it is the only way to meet those expectations.

The logic is visible in the prices. Consumer subscriptions were, according to analysts, long “priced for growth, not for profit”: acquire users first, make the market dependent, then monetize. That acquisition phase is now largely over — and the bills are starting to show it:

• Token prices are rising. Enterprise token rates have risen more than 60% since December 2025, according to J.P. Morgan.[24]
• The flat monthly fee is giving way to metered rates. GitHub Copilot fully switched from a fixed subscription to “AI Credits” billed per token on June 1, 2026.[25] OpenAI’s Codex switched to token billing on April 2, 2026.[26] Windsurf raised its subscription from $15 to $20 per month.[27] Cursor introduced compute-based pricing plus a $200 Ultra plan.[28]
• The bills for agentic coding are substantial. Anthropic itself reports an average of about $13 per active developer day for enterprise deployments of Claude Code.[29] Microsoft dropped Claude Code internally because token costs ran up to $500 to $2,000 per developer per month.[30] J.P. Morgan calculated that a single engineer can consume up to $730 per month in tokens — a Fortune 500 company with 5,000 developers quickly exceeds $3.5 million per month.[24]
• Why? Because flat-rate is loss-making. Extensive cost analyses show that Anthropic already hits zero gross margin at 10% utilization of its most expensive plans, and OpenAI runs a loss once Plus users exceed 11.4% of their limit.[31][32] Someone who truly maxes out a $200-per-month Claude Max 20x subscription consumes an estimated $8,000 per month in tokens.[32]

So behind the message “you don’t need developers anymore” stands a neatly designed acquisition machine. That message is not disinterested advice, but the growth strategy of companies losing billions that have promised to earn them back through volume. The more you have built, the more tokens flow — and the more you pay.

Add that to the earlier problem and the circle is complete: you buy a product whose quality you cannot judge, through a pricing model you cannot predict, driven by shareholders who demand growth. The hardware store at least honestly sells you an angle grinder at a fixed price. The AI industry sells you a meter that runs on everything you cannot see.

So what should you do?

The honest closing note: AI assistance is fantastic, including for professionals. Anyone experienced who uses AI responsibly — with code review, automated tests and a human who understands what is happening — builds faster and more safely. Willison calls that “vibe engineering”: same tools, different discipline.[6] AI amplifies existing expertise; it does not replace it.

The rule of thumb for anyone considering building without programming knowledge is simple and old:

The bomb-proof fuse box does not exist. Neither does the secure application — there is only code that someone has understood, and code that nobody has understood. Vibe coding without that understanding someone is not the first category.