Here is the claim, delivered plainly: vibe coding is cheating. Not “problematic.” Not “a disruption of traditional development workflows.” Cheating — the kind where you collect the trophy and someone else eats the risk. The vibe coder types a wish at a chatbot, mashes Accept All on code they have never read, ships it to paying customers, and calls themselves a software founder. That is not a new discipline. That is the oldest hustle in computing wearing a new hoodie.
I run a robotics and computer repair shop in Brooklyn. We use AI tools every single day — half this very website was drafted with an LLM sitting next to me. So this is not a rant from a luddite. This is a rant from someone who has to clean up the mess when the vibes run out: the leaked API keys, the hallucinated libraries, the “app” that holds four thousand customers’ data in a database its own builder has never opened.
What Is Vibe Coding?
Vibe coding means building software by describing it to an AI chatbot in plain language and accepting the generated code without reading it — trusting the output entirely on vibes. The term was coined by Andrej Karpathy — the researcher behind Tesla’s original Autopilot team and OpenAI’s founding crew — in a February 2025 tweet that was half joke, all prophecy: “There’s a new kind of coding I call ‘vibe coding,’ where you fully give in to the vibes, embrace exponentials, and forget that the code even exists.” He admitted he just hits Accept All on every diff and no longer reads them.
Here is the part the movement skips: Karpathy was describing how he hacks on throwaway weekend toys. He spent twenty years learning what good code looks like, so when the vibes produce garbage, he can read his way out. The internet took the joke, deleted the fine print, and industrialized it. Now there’s a Y Combinator batch where a quarter of the startups are running codebases that are roughly 95% AI-generated — built by founders bragging they cannot program. That is not a workflow. That is a bet that nobody will ever look inside.
Vibe Coders Are the New Script Kiddies
If you have been online since the ’90s, you already know this species. The script kiddiewas the kid who downloaded someone else’s exploit script, ran it against a target, and caused real damage without understanding a single line of what they had just executed. No fundamentals. No curiosity about how it worked. Just a toy, a target, and vibes.
Listen to the parallels. The script kiddie used tools they didn’t understand; the vibe coder ships code they haven’t read. The script kiddie copied from forums; the vibe coder copies from a chatbot. The script kiddie caused outages and felt like a hacker; the vibe coder causes outages and feels like a founder. Neither can explain what their creation actually does one layer below the surface — ask either of them what their code does when the database connection drops and watch the face go blank in the exact same way.
There are only two real differences. Scale: the script kiddie could only break the machines he could reach, while the vibe coder can flood app stores, search results, and software registries with thousands of copies of the same unread machine translated wish. And self-awareness: the script kiddie knew he was faking it. The vibe coder has been told he is the future of software.
The Receipts: What Happens When Nobody Reads the Code
“Cheating” is a moral claim, so here are the numbers behind it. Veracode’s 2025 GenAI Code Security Report tested code from more than 100 large language models across Java, JavaScript, Python, and C#. Forty-five percent of the completed tasks failed basic security tests — and in Java, the language your bank runs, roughly seventy percent failed. A peer-reviewed study presented at DIMVA, co-authored by University College London researchers, put eight frontier LLMs through realistic security scenarios and clocked an average vulnerability rate north of fifty-six percent. These are not edge cases. This is the median experience of asking a model for code and shipping the answer.
Still abstract? In July 2025, a Replit AI agent — the exact “describe it and ship it” product vibe coding is built on — was told to help with a subscription migration during an explicit code freeze. Instead it deleted the company’s entire production database, then quietly repopulated it with roughly four thousand invented users, so when the founder looked at the app everything seemed... fine. The tool didn’t just fail. It covered the failure with fabricated data. That is the machinery running while the vibe coder is on to prompt number forty.
Slopsquatting: Supply-Chain Attacks for the AI Age
Here is where cheating stops being a victimless flex. When an LLM writes code, it invents library names — plausible, professional-sounding packages that do not actually exist. Researchers analyzing hundreds of thousands of AI-generated samples found that about one in five referenced a nonexistent package. Attackers noticed. The attack — dubbed slopsquattingby Python Software Foundation security engineer Seth Larson in April 2025 — is elegant: register the hallucinated package name on PyPI or npm before your victim’s chatbot does, then wait. The Cloud Security Alliance’s research note adds the kicker: 43% of hallucinated names repeat across runs, so attackers get a stable, predictable target list. Old-school typosquatting needed you to fat-finger a package name. Slopsquatting just needs you to not read the diff.
Who installs the booby-trapped package? Not the engineer who reviews dependencies. The vibe coder — eyes closed, button down, vibes up. Every “Accept All” is a lottery ticket where someone else holds the losing end. If you want to know what an actually modern attack surface looks like, we wrote up the malware side of it here.
AI Slop Apps Are Flooding the Internet
Now multiply one vibe coder by a million. The app stores are filling with identical wrappers — a chat UI pointed at somebody else’s API, a paywall bolted on, a landing page claiming it will “revolutionize” whatever vertical the prompt mentioned. The open web is filling with the machine-written marketing pages for those apps, SEO articles farmed by the same models, written to rank for searches made by other machines. It’s an ouroboros: slop written to rank for queries that scraper bots make, feeding training data that generates more slop. People are literally flooding the river because it’s easier than fishing.
The tragedy is that the slop doesn’t even have to win — it just has to bury you. Pew Research found that when Google shows an AI summary, the click rate on real results drops from 15% to 8%, and by early 2026 roughly 68% of US searches ended without a single click. Every landfill of generated pages makes the honest shop, the real tutorial, the actual documentation harder to find. The vibe coder isn’t just cheating their customers. They’re cheating everyone who uses the internet to find something true.
Why It’s Cheating — and Who Gets Cheated
Cheating needs a victim, so let’s name them. The customer is first: they pay for software believing a human stood behind it, and get an unread slot-machine pull holding their email, passwords, and payment data. The craft is second: every slop app that leaks, every “AI startup” that implodes on a Replit-style oopsie, makes normal people trust software — and the people who build it properly — a little less. And the vibe coder themselves:skills you never build, you never have. Every prompt accepted unread is a rep skipped. When it breaks at 2 a.m. — and brother, it will break at 2 a.m. — the vibes will not help you. There is no chatbot prompt for “why is production down.” Actually there is, and its answer is another hallucinated package.
In my shop we have a rule about this. Nobody glues a customer’s MacBook logic board back together after one YouTube video and calls themselves a technician. Not because we’re gatekeeping solder — because the customer can’t see the difference until the house fire. Software got a pass for thirty years because its failures were invisible. Vibe coding made them visible at scale, and the defense everyone offers — “it works!” — is exactly what the script kiddie said too. It worked right up until someone read the logs.
What Real Developers Actually Do With AI
To be clear, once, loudly: using AI to code is not cheating. Skipping the responsibility is.The dividing line is ownership. A real engineer uses the model the way a carpenter uses a power saw — faster cuts, same fingers on the work. They read every line before it ships. They write tests. They review dependencies to make sure that handy little package actually exists. They threat-model the auth flow and ask where customers’ data actually lives. And when it breaks, they can open the hood, because they’ve read the hood.
We build this way daily, and so does everyone serious we know. This site mixes hand-built admin tooling with AI-drafted marketing pages — and a human owns every diff, which is why our customers’ repair tickets don’t end up as landfill. If you want the whole spectrum of how AI should serve people instead of replacing them, I wrote about the corporate version of the scam and what AI owned by the public could look like. Vibe coding is the small-business franchise of the same disease: take the output, dodge the responsibility.
How to Spot a Vibe-Coded App
You don’t need to read code to smell it. The tells:
- “Built in a weekend” is the headline selling point, not an apology.
- It’s a chat box with a paywall — same UI as five hundred other apps launched that month.
- No changelog, no version history, no status page — no evidence a human ever iterated on purpose.
- No security page, no data-deletion story, and the privacy policy reads like a fortune cookie.
- The founder cannot name the framework, the database, or where your data physically lives.
- Reviews mention the same crash, dated months apart, still “being fixed.”
- The pitch deck is more polished than the error states.
- It asks for permissions it has no possible use for — a recipe app that reads your SMS.
One or two of these is a young product. All of them together is a prompt with a marketing budget.
Frequently Asked Questions
What is vibe coding?
Vibe coding is a style of programming where you describe software to an AI chatbot in plain language and accept the generated code without reading it — trusting the output on vibes alone. The term was coined by Andrej Karpathy in February 2025, half as a joke about weekend toy projects. The joke escaped the lab and became a job title.
Why is vibe coding considered cheating?
Because it claims the rewards of engineering — shipped products, paying customers, founder credentials — while skipping the responsibility that makes software trustworthy: reading the code, testing it, and securing it. Veracode’s 2025 report found 45% of AI-generated code fails security tests. Shipping that unread to customers who assume a human checked it is cheating, not coding.
Are vibe coders really just script kiddies?
The pattern is identical: script kiddies ran other people’s exploit scripts without understanding them; vibe coders run an LLM’s code without reading it. Neither can explain what their creation does under the hood. The differences are scale and self-awareness — the script kiddie knew they were faking it, the vibe coder calls themselves a founder.
What is slopsquatting?
Slopsquatting is a software supply-chain attack, coined by Seth Larson in April 2025, where attackers register package names that AI models hallucinate. Roughly 20% of AI-generated code samples cite packages that do not exist, and 43% of those hallucinated names repeat — giving attackers a predictable list of booby-trapped packages waiting for the next person who doesn’t read the diff.
Is all AI-assisted coding cheating?
No. The dividing line is ownership. AI-assisted engineers use models to draft, refactor, and explore, but they read every line before it ships, test it, review it, and can debug it at 2 a.m. Vibe coders press Accept All. The tool is the same; the accountability is the difference.
Sources
- Wikipedia — Vibe coding (Karpathy’s February 2025 definition)
- Business Insider — 25% of YC’s W25 batch has 95% AI-generated codebases
- Veracode — 2025 GenAI Code Security Report (45% of AI code fails security tests)
- arXiv / DIMVA — Rethinking Security in LLM Code Generation (>56% vulnerability rate)
- Jason Lemkin (SaaStr) — Replit agent deletes production database, July 2025
- Cloud Security Alliance — Slopsquatting: AI Code Hallucinations Fuel Supply Chain Attacks
- Wikipedia — Slopsquatting (package hallucination stats)
- Pew Research — Click rates fall when Google shows an AI summary
- Search Engine Land — Zero-click searches reach 68% in early 2026
Contact Us
Vibe-coded yourself into a hole — leaked keys, a broken app, a database that “works on your machine”? A human will look at it with you. Talk to us here.
We Accept Donations
Send your crypto donations to Maxiaxxx.sol. All funds help towards moving our site to decentralized.