No. Not by default, and not because vibe coding is a bad way to explore an idea. Every major independent study published since Veracode's 2025 GenAI Code Security Report has converged on the same finding from different angles: code written primarily by an AI assistant, with light or no human review, carries measurably more security and stability defects than code written by a person and checked by another person. The gap is not marginal. It shows up whether you measure vulnerabilities, code churn, or how confident developers feel about work they haven't actually tested.
That is a different claim to "AI-generated code is bad." It isn't. It's a claim about what happens in the space between generating code and shipping it, which is exactly the space vibe coding was designed to skip.
What "vibe coding" actually means
Andrej Karpathy coined the term in a post on X on 2 February 2025, describing a mode of building where you stop reading the code the model produces and just react to whether the result feels right. His own description of the workflow was blunt: "I just see stuff, say stuff, run stuff, and copy-paste stuff, and it mostly works." Collins Dictionary later named "vibe coding" its Word of the Year for 2025, a sign of how far the term travelled beyond software teams into general use.
Karpathy was describing prototypes and weekend projects, not production systems handling real user data. The distinction matters because a large share of the software now being built this way doesn't stay a weekend project. It becomes the app a founder charges customers on.
The security data
Security is where the evidence is most direct, because it's the easiest property to test for automatically.
Veracode's finding lines up with a smaller but methodologically tighter study. Stanford researchers Neil Perry, Megha Srivastava, Deepak Kumar and Dan Boneh ran a controlled experiment (published as "Do Users Write More Insecure Code with AI Assistants?", arXiv:2211.03622) splitting participants into a group with access to an AI coding assistant and a group without. Across five security-relevant programming tasks, the AI-assisted group wrote less secure code on four of them than the control group. The more unsettling half of the result: participants using the assistant were also more likely to believe their code was secure than those who wrote it themselves.
That combination, more defects paired with more confidence, is the actual risk profile of vibe-coded software. It isn't that the code fails obviously. It's that nobody involved has a strong signal telling them it might.
CodeRabbit's "State of AI vs Human Code Generation" report, published in December 2025 after analysing 470 open-source GitHub pull requests, found AI-co-authored PRs carried roughly 1.7 times more issues overall than human-only PRs, with security-specific issues up to 2.74 times higher, logic and correctness issues around 75% more common, and readability issues roughly three times more common. Three separate methodologies, three converging answers.
Where the studies agree, and where they don't
What they agree on: AI-generated code fails security checks at a materially higher rate than human-written code, across every major programming language tested, and the gap hasn't been closing as models have improved. They also agree that the failures cluster around the same categories every time: input handling, authentication logic, and secrets management, which is exactly the kind of code a vibe-coding workflow is least likely to get reviewed carefully, because it doesn't look broken.
Where they differ is scale and mechanism. Veracode is measuring the model's raw output on isolated tasks. Stanford is measuring what happens once a human is in the loop making decisions with the model's help. CodeRabbit is measuring real pull requests from real projects, where the code has already survived some amount of human attention. That the numbers still point the same direction across all three contexts is the reason to take the finding seriously rather than as a quirk of one benchmark.
It isn't only security
Security gets the headlines, but the maintainability data is arguably more relevant to a founder deciding whether to keep building on a vibe-coded base. GitClear's 2025 AI Copilot Code Quality report analysed 211 million changed lines of code from 2020 to 2024, drawing on repositories from Google, Microsoft, Meta and enterprise sources. It found that refactored or moved code, the kind of change that indicates someone is actively improving the codebase's structure, fell from about 25% of changed lines in 2021 to under 10% by 2024. Over the same period, copy-pasted code rose from 8.3% to 12.3% of changes, and 2024 was the first year on record where copy-pasted code outweighed refactored code. Code churn, meaning code rewritten or reverted within two weeks of being committed, roughly doubled over the same window.
None of that is a security bug. It's a slower, compounding cost: a codebase that accumulates duplication instead of shedding it, and where the same problem gets patched in three places instead of fixed in one.
You don't need a report telling you what's wrong. You need it fixed.
Connect the repo, get a fixed-price quote, and a named engineer hardens the security, stability, performance and deployment gaps in a pull request you review and merge yourself.
See how the audit works →Why developers trust it anyway
The adoption side of this story explains why the risk keeps growing rather than levelling off. Stack Overflow's 2025 Developer Survey found 84% of developers now use or plan to use AI coding tools, up from 76% the year before, even as trust in the accuracy of that output fell to 29%, down from 40% in 2024. Reporting on separate research from Snyk found a more specific version of the same contradiction: 75.8% of developers believe AI-generated code is more secure than code written by a person, while more than 56% separately admitted that AI-generated code had, in their own experience, sometimes or frequently introduced security issues.
Put those two numbers next to each other and the picture is plain. Developers are using AI tools more than ever, trust the output less than ever in the abstract, and still hold onto a belief that it's probably fine when it's their own project on the line. That gap between stated caution and actual behaviour is where unreviewed vibe-coded software ends up in production.
So is it safe?
Safe enough to build with. Not safe enough to ship untouched. The evidence doesn't support treating vibe coding as reckless by nature, and it doesn't support treating it as production-ready by default either. It supports a narrower, more useful conclusion: AI-generated code needs the same thing human-written code has always needed before it handles real users and real money, which is a second, qualified set of eyes that didn't write it.
Is AI-generated code safe to ship to production?
Not without review. Independent studies from Veracode, Stanford and CodeRabbit all find AI-generated code carries a materially higher rate of security and logic defects than human-written, human-reviewed code, even though it usually runs correctly on the happy path.
What's the biggest risk in vibe-coded applications specifically?
The combination of more defects and more developer confidence. Stanford's controlled study found participants using an AI assistant wrote less secure code while believing it was more secure, which means the usual warning signs of risky code often don't show up.
Does more advanced AI model quality fix this over time?
Not so far. Veracode's 2025 report found security pass rates have stayed roughly flat, around 55%, across two years of newer model releases, suggesting the gap is more about workflow (no review step) than raw model capability.