In February 2025, Andrej Karpathy described "a new kind of coding I call vibe coding": you describe what you want, accept what the model writes, and "forget that the code even exists". He meant it for throwaway weekend projects. The industry took it much further.
For prototypes the effect was real. People who had never shipped software built working tools in an evening. Inside companies the picture was mixed, and two studies set the tone [2] [3].
METR ran a randomised trial with 16 experienced developers on 246 real issues in their own repositories. With AI tools allowed they took 19% longer; beforehand they expected a 24% speed-up, and afterwards they still believed they had been 20% faster [2]. The gap between how fast it feels and how fast it is was the real finding.
On quality, Veracode tested code from many models on security-relevant tasks and reported that 45% of the code samples failed security tests and introduced OWASP Top 10 vulnerabilities. The code worked; it just was not safe.
Neither study says "do not use AI to write code". They say the review, the tests and the security checks are not optional, and that the person merging the change still owns it [2] [3]. A team that ships more code with the same review capacity is shipping more unreviewed code.
What to do about it
Keep the speed and add the brakes: tests that must pass before merge, an automated security scan on every AI-written change, and a named reviewer who is not the author. Our Build service writes the evaluations first, then builds the system that passes them. See Build.
