Vibe coding is productive—and dangerously easy to trust. The term spread across the tech world since early last year, after OpenAI co-founder Andrej Karpathy described generating code by talking to an AI model without really thinking about the code itself. “I just see stuff, say stuff, run stuff, and copy paste stuff, and it mostly works,” he wrote.
That workflow is now the new normal in the tech industry. It also creates a problem that productivity charts tend to leave out: code you do not understand or review can expose you, your devices, and anyone using your app to serious security risks.
Five practices that keep AI-generated code from becoming your problem
1. Review code before it earns trust
AI-generated code still needs human review, especially when the person using it does not fully understand what the model produced. The danger is not that the code fails in an obvious way; it can work well enough to ship while creating security issues for the app and its users.
Apiiro looked into Fortune 50 companies and found that vibe coding made engineers four times more productive but produced ten times the number of security issues. That is an impressive productivity multiplier, if your business model includes manufacturing vulnerabilities at scale.
2. Treat devices as part of the security boundary
Michael Bailey, a professor at the School of Cybersecurity and Privacy at Georgia Tech, says security in the era of AI worms will look much like current systems security. His checklist is direct: patch devices, use isolation, choose good passwords, and practice good hygiene.
Bailey says “even misbehaving agents are going to have a hard time if they’re up against hardened devices.” The point applies beyond AI-generated apps, because insecure connected devices can become useful parts of a botnet even when they were never designed for that role.
3. Do not confuse a working prototype with a safe product
AI tools are moving from software into physical design. Deehan, a 42-year-old with a workshop in his East Lansing house, needed a small piece of steel to secure a camper to his truck. While using OpenAI’s GPT-6 Astra in voice mode, he described the piece and the angle at which it would sit; five minutes later, the chatbot had prototyped it.
Zhou, who previously worked on the iPhone cases team at Apple, is now a design engineer at Vizcom. Fitzgerald wanted to return to robotics after pivoting to crypto, and the two text new ideas between San Francisco and New York; Fitzgerald is more interested in making robot arms. Using a text-to-CAD tool, the 31-year-old designed an arm in sheet metal and paid about $—the available fact ends there, because apparently even the price tag needed a prototype.
4. Assume safeguards can fail
Chris Canal, CEO of EquiStamp, says small AI models may be only months away from replicating and spreading across insecure devices, creating slow but hard-to-kill autonomous botnets. Experts Engadget spoke to broadly agree that small models could become capable of self-replicating in the near future.
“It’s maybe a little earlier than I would have said. I would have predicted something more like summer of next year as the time I’d be really worried about this,” Canal said. He connects the pace of model advancement to employees at Anthropic and other frontier labs using their own AI tools for machine learning research.
Anthropic’s Frontier Red Team proposed the scenario, but Bailey takes issue with calling it self-replication. A real-world AI botnet might act more like a dropper that gains access to a device and installs other code; for an AI botnet to change its signature and behavior like a polymorphic worm, it would need to retrain its own models, which Anthropic did not attempt.
5. Use old security controls before chasing new ones
Bailey says Mirai already demonstrated the basic threat. Cybercriminals built a large botnet from everyday IoT devices, used it in a DDoS attack against Sony’s PlayStation Network, and affected Dyn, one of the largest DNS providers in the US.
That 2016 attack knocked Amazon, GitHub, PayPal, Reddit, and Twitter offline for many users across the US and parts of Europe. Sony estimated about $2.7 million in lost net revenue. Bailey says more capable AI models may “redistribute” who does the work of creating botnets, not invent an entirely new category of damage.
Anthropic’s mitigations sound old-fashioned because they are: ISPs could notify customers of infections and limit internet access to a short list of safe websites, a strategy used during Mirai. The company also points to the UK, where the PSTI Act bans easily guessable default passwords on IoT devices.
Safety boundaries are expanding beyond code
OpenAI is also tightening limits on weapons-related information for teens, even when a question “appears harmless.” It said ChatGPT will restrict practical information about weapons and security systems that could facilitate violence, while still supporting violence prevention, de-escalation, help-seeking, and connection with a trusted adult.
The policy applies to all users in other areas, including reconstructions of past mass attacks that detail weapons, equipment, acquisition methods, or comparisons of harm that could amplify an attacker’s notoriety. OpenAI announced these safeguards after a wrongful death lawsuit last year and after CEO Sam Altman apologized for not alerting police to alarming chat logs related to the Tumbler Ridge shooting earlier this year.
OpenAI plans to publish its first Community Safety Report in early 2027, followed by updates every six months. Until then, the practical rule for vibe coding remains less glamorous: review what the model writes, harden the devices around it, and do not mistake speed for safety.
Based on
