That’s what AI code tends to do. It looks fine to the outsiders, it might even function correctly MOST of the time. Programmers are trained, mostly through experience but also classically, to think through every exceptional case and figure out how to handle it (or return an error so a human can handle it).
That isn’t to say this is ALWAYS the case with AI code, but rather it TENDS to be the case. YMMV, which is where these warnings are coming from.
Unfortunately, vibe coding is seen as acceptable to many specifically because what you say here hasn't been the norm for like 15 years now.
The rise of bootcamps, dependency-driven-development, and "move fast and break things" culture convinced a whole generation of programmers that all that matters is the happy path, and even then, only within the context of today's specific task. The ocean of garbage they produced during that time is both one of the reasons why LLM's can produce code in the first place and one of the reasons why that code is so consistently and irrecoverably poor by traditional standards. Aspiring vibe coders see their peers earning absurd six-figure salaries to produce the exact same sort of unstable, short-sighted noise that they see their LLM literally reproduce for pennies now.
In many ways, we should be gatekeeping by asserting a higher standard of foresight and quality for redistributed code, but we completely lost that battle many, many years ago already.
Most code (even written by good programmers) rarely functions correctly most of the time. Most code is broken. This is not the problem with AI. Unless I am using the tools wrong, LLMs can generate fully functioning scripts (and some of them are good) but they break after the 50k token context and start doing insane things that not even juniors will do (like randomly removing code).
If you want to see a shit-show, go to Bolt Discord channel. Some users are able to get a very simple and rough kinda single script app running. Everything else breaks once they start making simple amendments. This is not fixed by Claude 3.7 or O1 Pro or whatever. This is a fundamental issue in all of the LLM and a local maxima of the current tech.
Not that the current tech is not amazing. It is and there is a lot of value to be extracted from it. But everyone and his investor think they are about to reach nirvana and want to replace everything with "AI" where "AI" is a 100k context LLM.
When a post is a "warning" about user's credit cards etc. and it was in none of the "vibe coding" examples, that feels like someone deflecting (but with a gate keeping mindset).
As others have said here, I too have knocked out little apps and sites vibin'. At first (1) it was to see if what everyone was saying about LLMs was true. Then (2) I wanted to see if LLMs could help in languages I was not familiar with. Then, even for languages I knew well enough, I (3) wanted to see an LLM's code to get the modern method of modularization for the language (JavaScript is one that has gone through phases). Finally I came to trust the machine and (4) have vibed code just for my own small projects.
Gatekeeping is restricting access to the trade with arbitrary precedence, like "real coders use emacs." It's not expecting safety. If someone wants to build a bridge out of cotton the city won't let them. That isn't what most people consider gatekeeping.
Vibe coders as described in the OP can just copy/paste exactly what the LLM spits out with much less knowledge. It’s not the same thing at all IMO.
If you only take exactly what the LLM spits out you can only verify by running. If it is broken in edge cases you can only prompt the LLM to fix. You then have to run the code again to verify the fix, and with zero understanding it may have broken some other edge case (LLMs do this all the time especially overly eager reasoning models).
It might be, it might not. My colleagues and I are also guilty of introducing unrelated edge cases, but again, we do fine.
The case you're describing is also fairly pathological. There's nothing stopping a vibe coder from digging into their code and becoming a 20% monster like me.
Consider that the world is full of programmers who are objectively shit (I live in India, and have personal experience). The only difference is that they’ll be copy pasting from ChatGPT instead of StackOverflow, and honestly I’d rather have ChatGPT.
Isn't that the definition of gatekeeping? and even so, who cares? the new guy coming in creating/doing something in a way that "shouldn't be done" will eventually fail and notice the shortcomings of what they did. Then they will either drop their project or learn the way "it should be done" (like we all did, except now with AI).
I write really bad Haskell code sometimes without any AI assistance. Am I doing a Bad Thing when I create my own tools?
What are you intending to regulate here?
It appears to be happening right now in the US federal government.
Do you have an example?
The benefit and excitement is most felt by people with little to no experience writing code themselves. The fear seems to come from building.. what, code for critical infrastructure? That's just not what we're talking about here.
Then hopefully they run on a computer without network access, otherwise everything is safety critical.
But to build something which could handle a customer’s credit card, password, or other PII and charge them for it, you better know what you’re doing.
It’s all fun and games until you’re the cause of someone’s identity or password getting stolen.
Anyone can use CAD software, but if you’re designing a public space, you better know something about safety.
AI is just another vector for this, not something entirely new.
When you have your amazing idea, instead of hiring an inexpensive low-skill developer (whose work you are also incapable of evaluating) to build and ship your idea in a low quality way, you're just paying AI to do it.
It's just putting they money into different (centralized) pockets.
When a non-technical person hires an incompetent developer (that they likely don't know is incompetent at the time of hiring) to build something that turns out to be insecure - because the developer didn't know any better and the non-technical person doesn't have the skills to evaluate the output - no one was trying to do a bad thing, but they didn't know what they didn't know.
The non-technical person got something that did what they asked, without understanding all the underlying deficiencies.
It's the same with AI, I don't think non-technical people using AI are thinking "I don't care that this is building garbage code full of problems"..
Just like the first scenario, they don't know what they don't know, and they end up with something that does what they want, and that's a good outcome based on their limited knowledge.
To be clear, I don't think either of these scenarios is excusable or acceptable if you're working with PII or other security-sensitive things, I was just pointing out that this isn't new.
Anyone can play the violin. Anyone can run a marathon. Anyone can …
People who spent their lifetime never quite able to sit down and write programs, for whatever reasons (time, focus, foundational knowledge, available mentors), have in the last year shipped working apps/scripts, by just saying in plain english what they wanted. That's exciting.
So, you pay the billionaires to rent their graphics cards so you can avoid paying a normal person? -_-
Don't hold your breath. If the AI was good enough to do all that, "maintainability" would look very different from what it does today. What does it mean to be maintainable when an AI can completely rewrite the software in every iteration? If AI ever gets good enough to do all this, for safety-critical applications no less, probably 95% of the white collar jobs that exist today will be gone. There may also be robots to do 90% of all other work too.
The vibe coding style translates to trying a lot of different prompts and small adjustments until it looks like it works. In the past these people copied from StackOverflow and poked at lines until it compiled and appeared to work, but that only gets you so far. Now those same people can bang away at an LLM assistant all day long and produce volumes of code that appear to kind of work.
I’m in another forum dedicated to programming careers. Every day there’s a new thread from someone asking how to deal with all of their junior employees spamming code review with obvious LLM generated code that they don’t even understand.
A lot of the defenses of vibe coding rely on the assumption that it’s in the hands of someone knowledgeable who only wants to save a little time for something inconsequential. That’s fine. What’s worrying is that vibe coding is being used as a replacement for understanding code for many juniors and lazy seniors across the industry as long as they think they can get away with it.
Another potential alternative is that these things progress quickly and soon can code and review code at or above the level of most SWEs. I suspect that's driving a non-zero amount of anxiety in the comments.
I'm not an SWE, and frankly, they're above my level today. Saying "plz don't code if you can't understand it" applies to my code today without AI assistance. Are you suggesting I shouldn't release anything because others might need to read it? The way to prevent this within an organization is smart hiring practices, not restrictions on tool use.
worried? we're going to make a goddamned fortune
The people tasked with cleaning up the mess and making it usable in production do the remaining 80% of the work, but management is always disappointed that it’s going so slow relative to how quickly the proof of concept was created.
At one company it was widely known that the key to taking credit for technical work was to be the team presenting the GUI pieces to management. If you were working on something that couldn’t be shown to management with a “wow” factor, you were not valued. I see the same thing happening here, with vibe coders capturing the wow factor and the people who actually make it production stable being viewed as the slow and expendable ones.
I just want a free script or addon that will do its job instead of paying someone on upwork to do it for me. simple as.
Additionally it's only up from here. The agents will be able to do maintainable code and safety critical code at some point in the future. It's not all gonna happen overnight.