Georgia Tech study reveals 74 vulnerabilities in Andrej Karpathy's vibe coding

Vibe coding, a term popularized by AI researcher Andrej Karpathy, is gaining traction in software development, particularly among those who utilize large language models (LLMs) to generate code. Karpathy first introduced the concept in February 2025, describing it as a coding approach that embraces the capabilities of LLMs while minimizing traditional coding practices. The rise of vibe coding reflects a significant shift in how software is developed, driven by advancements in AI technology.

The growing popularity of vibe coding has sparked a debate within the tech community. Advocates argue that it democratizes coding, making it accessible to individuals without formal programming backgrounds. For instance, a veterinary technician was able to create an app to track her cat's insulin shots using vibe coding, showcasing its potential for practical applications. However, critics warn that relying heavily on AI-generated code can lead to vulnerabilities and maintenance challenges, as many vibe coders may lack the necessary skills to troubleshoot issues when the AI fails to deliver.

Research from Georgia Tech's School of Cybersecurity and Privacy highlights these concerns. In April, researchers identified 74 vulnerabilities linked to AI-generated code within a sample of 43,000 security advisories. Among these, 14 were classified as critical security issues. While this number may seem small, it represents only a three-month period, and experts believe the true extent of AI-generated vulnerabilities could be five to ten times higher. This raises alarms as more professionals turn to vibe coding despite their reservations about its implications.

A recent survey of 1,100 professional programmers revealed that 72 percent use AI coding tools daily, with approximately 42 percent of their codebase being AI-generated or assisted. This trend suggests a significant shift, with many professionals predicting that AI-generated code will comprise more than half of their codebases by next year. As vibe coding becomes more prevalent, distinguishing between fully AI-generated code and code assisted by AI will be crucial in addressing the associated risks and ensuring the integrity of software development practices.