Vibe Coding Splits Developers as LLMs Write Nearly Half of Production Code

The Terminology Behind the Trend

Andrej Karpathy introduced the phrase in early 2025, describing a development style where programmers lean entirely on large language models to write code, treating the underlying logic as almost incidental. The former Tesla Autopilot Vision lead framed it as a natural evolution: as inference quality improved, developers could focus on intent rather than syntax.

Fifteen months later, the practice has moved from curiosity to mainstream workflow. Professional developers now report that roughly 42 percent of their production code either originates from or receives material assistance from an LLM, and internal forecasts suggest that figure will cross 50 percent within the year. The shift is fastest among teams using tools like Cursor Composer paired with Anthropic's Sonnet model, where autocomplete has evolved into full-function generation.

At DailyTechWire, we've tracked similar adoption curves across fintech startups in Singapore and SaaS teams in Bengaluru. The common thread: velocity gains are immediate, but the technical debt remains invisible until something breaks.

Security Researchers Sound the Alarm

A team at Georgia Tech's School of Cybersecurity and Privacy spent the first quarter of this year analyzing 43,000 security advisories. They identified 74 vulnerabilities with clear provenance to AI-generated code, 14 of which met the threshold for critical severity. The researchers estimate the true count sits five to ten times higher, constrained only by incomplete disclosure practices. Most AI-generated code carries no label, making forensic attribution difficult.

The vulnerabilities cluster in predictable categories: improper input validation, insecure deserialization, and authentication bypasses. These are not novel attack vectors, but they appear with higher frequency in codebases where LLMs handle boilerplate or edge-case logic. The model learns patterns from training data that includes decades of insecure code, and without explicit guardrails, it reproduces those patterns.

What makes the Georgia Tech findings particularly concerning is the time window. Seventy-four confirmed cases in three months, extrapolated across the global software supply chain, suggests thousands of latent issues already in production. Traditional code review catches some of these flaws, but review processes were designed for human-written code, where certain classes of error are rare. AI-generated code inverts those assumptions.

The Maintenance Problem Nobody Discusses

Security flaws represent the acute risk. The chronic issue is maintainability. A developer who prompts an LLM to scaffold a feature often lacks the depth to debug it when requirements change or an edge case surfaces. The code runs, tests pass, but the mental model required to extend or refactor it never formed.

This creates a new class of technical debt. Traditional debt accumulates when teams choose speed over elegance, deferring cleanup with full knowledge of what needs fixing. AI-generated debt is different: the original author may not understand what the code does, only that it works. When it stops working, the path forward is another LLM prompt, layering generated code on top of generated code.

We've seen this pattern in startup post-mortems across Jakarta and Manila, where founding engineers used vibe coding to reach product-market fit, then struggled to scale. Hiring senior developers to untangle the codebase becomes expensive, and rewriting from scratch often proves faster than deciphering the AI's logic.

Where Professionals Draw the Line

Survey data from Stack Overflow's 2025 developer census offers a more granular picture. While 47 percent of respondents use AI tools daily, 72 percent explicitly reject vibe coding as part of their workflow. Another 5 percent describe their rejection as emphatic.

The distinction matters. Most professional use falls into assistance: autocomplete, refactoring suggestions, test generation, and documentation. These applications keep the human developer in the driver's seat, using the LLM to accelerate tasks they already understand. Vibe coding, by contrast, treats the LLM as the primary author, with the human as editor or prompter.

The gap between those two modes is widening. Tools have improved to the point where a non-programmer can build a functional prototype, as evidenced by hobbyist projects like the insulin-tracking app built by a former veterinary technician. For hobbyists, the risks are contained. For production systems handling payments, health records, or infrastructure control, the calculus changes.

The Junior Developer Dilemma

The economic subtext is harder to quantify but increasingly visible in hiring data. Tasks that once fell to junior developers - writing boilerplate, implementing well-defined features, debugging syntax errors - are now handled by LLMs. Senior engineers, who previously delegated these tasks, now delegate them to Copilot or Cursor.

This compression has downstream effects. Entry-level hiring in software development has contracted across major tech hubs, from Seoul to Shenzhen. Bootcamp graduates and computer science juniors face a market where the traditional on-ramp has narrowed. The skills they developed to secure that first role are precisely the skills LLMs can now replicate.

Some argue this mirrors earlier automation waves: spreadsheet software eliminated legions of accountants, but the profession adapted. Others point out that software development was one of the few reliable paths into the middle class for young people without advanced degrees or family capital. If that path closes, the consequences extend beyond the tech sector.

Regulatory and Liability Gaps

No jurisdiction has yet established clear liability frameworks for AI-generated code. If a vulnerability introduced by an LLM leads to a data breach, who bears responsibility? The developer who accepted the generated code? The company that deployed it? The LLM vendor?

Current software licensing agreements from OpenAI, Anthropic, and Google indemnify the model providers in most scenarios. Enterprise contracts sometimes include security warranties, but these are narrowly scoped and difficult to enforce. The result is a liability vacuum, where the cost of AI-generated vulnerabilities falls on the deploying organization, often without adequate insurance or legal precedent.

We expect regulatory attention to intensify as high-profile breaches trace back to AI-generated code. The EU's AI Act includes provisions for high-risk systems, but software development tools currently fall outside that classification. In the U.S., CISA has begun tracking AI-generated vulnerabilities separately in its advisory database, a signal that federal oversight may follow.

What Comes Next

The vibe coding debate is ultimately a debate about abstraction. Every leap in developer tooling - from assembly to high-level languages, from manual memory management to garbage collection - has triggered similar arguments. Proponents celebrate democratization and velocity. Critics warn about lost craftsmanship and hidden complexity.

What distinguishes this transition is speed. Previous shifts unfolded over decades, giving education systems and professional norms time to adapt. LLMs crossed from experimental to ubiquitous in under three years. The gap between capability and oversight is wider than in prior cycles, and the stakes - given software's role in critical infrastructure - are higher.

For now, the profession is bifurcating. One cohort treats LLMs as powerful assistants, maintaining control over architecture and logic. Another leans into full automation, accepting the trade-offs in exchange for speed. The market will eventually price in the risk, but until then, the code keeps shipping, and the vulnerabilities keep accumulating.