What vibe coding actually is
Vibe coding is the practice of building software by describing what you want to an AI in ordinary language and accepting what it produces, without necessarily reading or understanding the underlying code. You type "build me a booking site for my salon with online payments and a customer login," and a tool generates the pages, the logic, and the database to match. You look at the result, ask for changes in plain words — "make the button bigger, add a cancellation policy" — and iterate by feel. By the vibes, hence the name.
The tools that do this have become genuinely capable, and the appeal is obvious. Building a custom website has traditionally required either learning to code or hiring someone who has. Vibe coding appears to remove both barriers. A non-technical owner can go from idea to working prototype over a weekend, for the price of a monthly subscription. That is a real and exciting shift, and I do not want to be the person who sneers at it. The problem is not that the technology exists. The problem is what happens when the output goes live without anyone qualified ever looking at it.
Where these tools are genuinely useful
Let me be fair to the technology before I get to the warnings, because I use AI coding tools daily and they have made me faster and, in some ways, better at my job. In the hands of someone who knows what good code looks like, these tools are a genuine accelerator. They handle the tedious, repetitive parts quickly. They are excellent for prototyping — for turning a vague idea into something you can click on and react to before committing to it. They are a wonderful learning aid. And for genuinely throwaway things — an internal tool only you will use, a quick experiment, a mockup to show a client — the stakes are low enough that the risks below barely matter.
The distinction that matters is between vibe coding as a starting point that a knowledgeable person then reviews, hardens, and takes responsibility for, and vibe coding as the finished product that goes straight onto the internet handling real customers and real money. The first is the future of how a lot of software gets built, and it is fine. The second is where businesses get hurt.
The security problem, in numbers
This is the part I need you to take seriously, because it is not my opinion — it is what security researchers keep finding when they actually examine AI-generated code, and the findings are remarkably consistent across independent studies.
One 2026 analysis found that around 62% of applications built with AI coding tools shipped with critical security vulnerabilities — not theoretical warnings, but exploitable flaws in live deployments. Researchers at Carnegie Mellon put it even more starkly: while roughly 61% of AI-generated code snippets worked correctly, only about one in ten passed a security review. A Georgetown study found that the large majority of AI-generated code failed to properly defend against a common web attack called cross-site scripting. And when one security firm scanned thousands of vibe-coded applications, it turned up hundreds of exposed secrets — live passwords, API keys, and access tokens sitting in the code where anyone could find them — along with instances of exposed personal information.
These are not exotic problems. They are the same categories of flaw that have plagued the web for years: databases left open to injection, logins that can be bypassed, secrets hardcoded in plain sight, out-of-date components with known holes, and packages that do not exist being recommended so confidently that attackers register them with malicious code inside. The AI produces something that works when you click through it, which fools the non-technical owner into thinking it is done. Working and safe are entirely different things, and the gap between them is exactly the expertise vibe coding skips over.
The consequences are not hypothetical. In early 2026, a founder proudly launched a platform he had built without writing a line of code himself. Within three days, security researchers found that roughly 1.5 million API keys had leaked out of it because of a misconfiguration the AI generated and no human caught. That is what "it worked when I tested it" can hide underneath.
The problem that shows up later
Security is the dramatic risk, but there is a quieter one that catches even more businesses, and it arrives months after launch when the excitement has worn off.
When a site is vibe-coded and nobody involved understands the code, you have a maintenance problem waiting to happen. Websites are not "done." They need updates when a dependency has a security patch, changes when your business changes, and fixes when something breaks. If the only thing that ever understood your site was an AI in a chat session that has long since ended, who fixes it when it goes wrong? You cannot describe the problem precisely because you do not know how your own site is built. The AI that generated it has no memory of it. And a professional you bring in to help now has to reverse-engineer an unfamiliar, machine-written codebase before they can safely touch anything — which is often slower and more expensive than if you had built it properly to begin with.
This is a real enough problem that a market has grown up around it: Canadian and international development shops now offer "vibe-code cleanup" services specifically to rescue businesses whose AI-built sites became unmaintainable or insecure. When the rescue industry for a technology is already established, that tells you something about how often the do-it-yourself version ends badly. The speed that felt like a saving at the start turns into a bill at the end.
It is worth being clear-eyed about the economics, because the cost illusion is the whole trap. The appeal of a vibe-coded site is that it looks nearly free next to a professional build — a monthly subscription instead of a proper project budget. But the price you see at the start is not the price you pay. Add the security review the code needs but did not get, the eventual cleanup or rebuild when it becomes unmaintainable, and the very real cost of a breach — lost trust, notification obligations under privacy law, the scramble to contain it — and the cheap option routinely ends up as the expensive one. I am not saying professional development is always the right spend for every business; sometimes a simple template site is genuinely all you need. I am saying that comparing the sticker price of unreviewed AI output against a proper build is comparing two different things, and the gap you think you are saving is often just risk you have not been billed for yet.
How to tell if you have been sold one
Not everyone building your site will announce that they are vibe coding it. Some inexperienced or unscrupulous providers use these tools to work far faster than their skills would otherwise allow, and pass the output off as professional custom development. A few honest questions will tell you a lot.
Ask who will own and be able to maintain the code after launch, and get a straight answer about where it lives and who can access it. Ask whether the site has had any security review, and what specifically was checked. Ask how updates and fixes will be handled over the next year, and by whom. Ask them to explain, in plain terms, how a particular feature works — a provider who genuinely built and understands your site can do this easily, and one who simply accepted whatever an AI produced often cannot. And be alert to the classic warning sign: a price and a timeline that are dramatically lower than everyone else's. Sometimes that is a genuinely efficient professional. Increasingly, it is someone shipping unreviewed AI output and leaving the risk with you. My separate article on choosing a developer goes deeper on the questions worth asking.
Using AI coding the right way
I am not telling you to avoid AI-built websites entirely — that would be both hypocritical and increasingly unrealistic. I am telling you to insist on the missing ingredient: a competent human who reviews the code, takes responsibility for it, and can maintain it. AI coding done right is a professional using these tools to work faster while applying the judgment the AI lacks, checking its output for exactly the security holes the studies keep finding, and standing behind the result. AI coding done wrong is nobody checking anything.
If you want to experiment with vibe coding yourself, do it where the stakes are low — an internal tool, a personal project, a prototype to clarify your own thinking — and treat anything it produces as untrusted until a knowledgeable person has reviewed it. Never let AI-generated code handle real customer data, real payments, or real logins without a proper security review first. And remember that for a great many small businesses, a well-built site on a maintained platform like WordPress remains a more sensible, more supportable choice than a bespoke AI-generated application nobody fully understands — a trade-off I dig into in my WordPress-versus-custom article.
This is exactly the line I hold in my own work. I use these tools because they make me more productive, but the code that goes live on a client's site is code I have reviewed, understood, hardened, and will maintain. The tool is an assistant, not the person responsible. That responsibility is the entire value a professional adds, and it is precisely what the vibe-coding-as-finished-product approach throws away.
The bottom line
AI coding tools are real, powerful, and here to stay, and in capable hands they are a gift. But a working demo is not a safe, maintainable website, and the research is clear that a majority of unreviewed AI-generated code ships with serious flaws. The businesses that get burned are the ones who mistook speed and low cost for a finished product, and discovered the true price later — in a breach, in a site they could not fix, or in a rescue bill bigger than doing it properly would have cost.
The safe way to benefit from this technology is simple to state: let AI help build your site, but make sure a real, accountable human being reviews it, secures it, and can look after it. Whether that is a professional you hire or a competent partner you work with, insist that someone understands the thing your business runs on. The vibes are a fine place to start. They are a dangerous place to stop.