Vibe Coding Has a Security Problem Nobody Wants to Talk About

Andrej Karpathy coined "vibe coding" in February 2025. Stop reading diffs. Accept all changes. Copy-paste error messages. Let the AI handle it. "I just see stuff, say stuff, run stuff, and it mostly works." 4.5 million people watched that tweet. A movement was born. A year later, we have data on what happens when millions of developers take that advice. The Numbers Are Bad Veracode tested over 100 large language models across 80 coding tasks. Result: 45% of AI-generated code contains OWASP Top-10 vulnerabilities. Two years of model improvements haven't moved that number. Models get better at writing code that compiles — not at writing code that's safe. Java hit a 70% failure rate. Python, C#, and JavaScript ranged from 38% to 45%. Cross-site scripting defenses failed 86% of the time. Log injection, 88%. A December 2025 paper from the University of Virginia sharpened the picture. Researchers tested coding agents on 200 real-world feature requests — tasks pulled from open-source projects