Seven critical vibe coding mistakes — and how to avoid them

A survey by SonarSource found that 48% of developers have adopted vibe coding for new projects and 62% say it's effective, but 96% don't fully trust AI-generated code, while a CodeRabbit report shows AI pull requests have 1.4 times more critical issues and 1.7 times more major issues than human-created ones. Experts like Brett Smith of SAS and Sonny Rivera of ThoughtSpot warn that organizations must apply the same testing and validation standards to AI code, and avoid mistakes like skipping product owner disciplines and ignoring dependency risks.

Vibe coding https://www.infoworld.com/article/4078884/what-is-vibe-coding-ai-writes-the-code-so-developers-can-think-big.html an application or an AI agent sounds too good to be true. A single developer prompts their way through a plan and has the code for a working prototype in minutes instead of days. Fixes and improvements come through iteration until the developer is satisfied with the results. According to the State of Code Developer Survey https://www.sonarsource.com/resources/developer-survey-report/ , 48% of respondents have adopted vibe coding for new projects, and 62% say it’s effective. But 96% don’t fully trust that AI-generated code is functionally correct. There’s reason for concern. The State of AI Versus Human Code Generation report https://www.coderabbit.ai/blog/state-of-ai-vs-human-code-generation-report shows AI pull requests have 1.4 times more critical issues and 1.7 times more major issues than when developers create the pull request. “Developers write bad code, and AI helps them write bad code faster,” says Brett Smith, distinguished software developer at SAS https://www.sas.com . “The fallacy lies in organizations assuming AI-generated code is inherently correct instead of subjecting it to the same testing, validation, and quality standards as every other release.” Subjecting AI code generation to the same testing as traditional code may not be sufficient. One report states that 41% of all global code is now AI-generated https://www.braiviq.com/blog/vibe-coding-ai-development-2026-cursor-copilot-claude-code . The code reviews, security scans, and testing practices deployed for developer-generated code may not support the volume, complexity, and new risks from AI-generated code. These metrics don’t suggest that vibe coding is bad, but they do suggest developers should slow down and avoid costly mistakes. Here are seven bad habits to avoid. “A common mistake I see is teams celebrating how fast assistants like Claude and Codex turn an idea into insight, while missing that the bottleneck has moved upstream to product management and semantics,” says Sonny Rivera, principal data and AI strategist at ThoughtSpot https://www.thoughtspot.com/ . “Ignore that shift, and you get the opposite of what you wanted: slower delivery and lower quality.” Vibe coding shouldn’t greenlight dated behaviors that developers know lead to software risks and development rework. Going from idea to code requires basic product owner disciplines https://drive.starcio.com/2016/04/10-practices-strong-agile-product-owners/ , including defining stakeholders https://drive.starcio.com/2022/08/relationships-business-stakeholders/ , identifying user requirements https://www.infoworld.com/article/2265572/when-to-incorporate-design-thinking-in-scrum.html , and establishing user story acceptance criteria https://www.infoworld.com/article/2258800/how-to-write-agile-user-stories-7-guidelines.html . How to avoid the mistake: Many code generation and vibe coding tools support a developer’s workflow without providing a formal collaboration process with stakeholders. Spec-driven development https://www.infoworld.com/article/4166817/vibe-coding-or-spec-driven-development.html is one way to address this gap. A team can collaborate with AI to create product requirement documents and architectural artifacts, make modifications, and then feed them back to AI to generate code. Mitchell Johnson, chief product development officer at Sonatype https://www.sonatype.com/ , reminds vibe coders that the code AI writes is only part of the equation. “Increasingly, AI is also deciding which open source components your application depends on. If those decisions aren’t informed by current intelligence, not just what the model learned months ago, you can end up building on outdated, abandoned, or risky dependencies without realizing it,” says Johnson. Enterprises have historically struggled to standardize their software development stacks. Over time, many ended up with the technical debt of maintaining applications across different development platforms and versions, adding to the cost and creating complexities when extending applications. This risk is amplified if there are no specifications of which frameworks, components, libraries, and their versions the vibe coding tools can build solutions from. How to avoid the mistake: Provide architecture requirements, specify a catalog of usable components, and update this documentation frequently, as open source and third-party component deployments may trigger new risks. Additionally, review every vibe-coded application’s software bill of materials https://www.cisa.gov/topics/information-communications-technology-supply-chain-security/sbom and the integrated APIs. Companies in regulated industries have development standards around security, reliability, auditing, and other nonfunctional requirements. Even when an application doesn’t have specific performance and scalability requirements, developers gain the expertise and have a general sense of user expectations. But without guidelines, vibe coding tools can make their own assumptions and pursue a development strategy that won’t scale. “Coding agents can genuinely, significantly boost your productivity, but they’re weak on nonfunctional requirements,” says Johnny Halife, CTO at Southworks https://www.southworks.com/ . “Architecture, hardening, and componentization on anything complex tends to come out hacky if you skip the design phase. Do those parts with a human in the loop, lock them down, and then let the agent run, because that’s where the productivity gains actually live, not in prompting ‘build me an app.’” How to avoid the mistake: Create a repository of categorized nonfunctional requirements for development teams to pull from for any new project or proof of concept. Apply this step and ensure application and AI agent–specific nonfunctional requirements https://www.infoworld.com/article/4061123/how-to-write-nonfunctional-requirements-for-ai-agents.html are captured and shared with AI coding tools. New developers on the team don’t always know what’s in the dev databases. A user registration database created from production data that was compliant 10 years ago may not meet today’s data privacy https://drive.starcio.com/2026/02/data-privacy-week-leadership-accountability/ requirements. Organizations that placed fewer controls on dev and test environments than on production may find they have new data governance https://drive.starcio.com/2024/10/6-important-ai-and-data-governance-non-negotiables/ risks to address before letting AI code generators access them. “Using AI coding tools in the database creates huge data compliance problems as developers overlook what’s sitting in their dev and test environments, exposing unmasked production data to a tool that can resurface the information at a moment’s notice,” suggests Tim Dalton, group product manager at Redgate Software https://www.red-gate.com/ . “AI-generated test cases can embed PII directly into scripts that end up in version control, and by the time the breach is caught in an audit, it’s already appeared dozens of times. Before integrating any AI tool into your workflow, teams need to ensure that their data is properly masked, cleaned, and governed—truly safe for use with AI.” How to avoid the mistake: Data governance teams should create a test checklist to validate any data source and define its data access entitlements before allowing an AI code generator to access it. When architecting cloud-native applications, a key mistake was developing the functionality without considering user access requirements. Some of these applications may have required small refactoring exercises to layer in security requirements, while more complex scenarios may have required re-engineering them. The costs and risks are compounded with vibe-coded applications that don’t have access guardrails defined upfront as part of functional requirements. “The pitfall is that people rarely add all of the necessary functions in the apps they’re vibe coding that cover security and entitlements, says Jason Matis, AI specialist solutions engineer at Kong https://konghq.com/ . “It’s usually just an open build with a happy path approach, and while this is great for minimum viable products, it is rough for production. When authentication, entitlements, and observability live in infrastructure rather than application code, it doesn’t matter how the app was built—the guardrails are already there.” How to avoid the mistake: Create standards for role-based access controls RBAC and reusable software components to manage them. Create a template for documenting access controls by function and include these requirements when vibe coding the implementation. Many organizations report automation coverage below 33%, according to the World Quality Report https://www.capgemini.com/insights/research-library/world-quality-report-2025-26/ . The report identifies eight quality engineering genAI use cases, such as test case design, requirements analysis, and defect analysis. All have below 50% adoption in production. This raises the question whether continuous testing https://www.infoworld.com/article/3705049/3-ways-to-upgrade-continuous-testing-for-generative-ai.html is sufficiently mature and scaled at organizations aggressively pursuing AI code generation and vibe coding practices. “One mistake teams make with vibe coding is relying on review alone to catch what the AI got wrong,” says Andrew Wyatt, chief product officer at Marker Collective https://www.markercollective.com/ . “The better pattern is to turn your engineering standards into guardrails the workflow cannot skip: tests, type checks, linters, security checks, evals, and observability requirements that run before code is accepted. AI can move incredibly fast, but the process should make the obvious mistakes hard to ship.” Harshil Shah, director of engineering and head of AI center of excellence at RSI https://www.rsystems.com/ , says the new rule of thumb is that your eval suite should grow faster than your codebase. “Teams that don’t invest in automated evals and regression harnesses are essentially shipping the model’s confidence, not its correctness.” How to avoid the mistake: Manual testing or no formalized testing practices are significant risks for organizations that believe that vibe coding empowers them to circumvent best practices in managing the software development life cycle SDLC , especially in testing AI agents https://www.infoworld.com/article/4086884/how-to-automate-the-testing-of-ai-agents.html . Developers today generally understand the importance of building observability into applications https://www.infoworld.com/article/3686056/best-practices-for-devops-observability.html , data operations https://www.infoworld.com/article/3687135/why-observability-in-dataops.html , and AI agents https://www.infoworld.com/article/4140832/7-safeguards-for-observable-ai-agents.html . When using AI code generators and vibe coding, parts of the SDLC are automated, and AI makes decisions on the developer’s behalf. Devops teams should review AI code generators and vibe coding platforms for their observability capabilities to trace outcomes and code back to the AI’s decision-making steps. Mat Ryer, senior director of AI at Grafana Labs https://grafana.com/ , says, “Vibe coding turns every stage of the SDLC into a place where AI is making decisions you can’t see unless you’re watching for it, such as when a prompt generates a function’s first draft, when a test suite gets written faster than a human could review it, when a deploy goes out because the pipeline said it was safe.” Raghuveer Subodha, EY distinguished technologist and AI engineering leader at EY Global Consulting Delivery Services https://www.ey.com/ , says that a common mistake is asking AI to catch its own bugs through vague prompting, like asking it to fix the code. “When prompted this way, AI adds many exception handlers to ensure the code compiles and runs, rather than diagnosing the problem. Better to ask AI to generate the entire stack trace and implement structured logging so the error can be identified and solved,” says Subodha. How to avoid the mistake: When developing AI agents, Ryer recommends treating observability holistically from start to finish, understanding why AI made a decision, reviewing what’s breaking, and reviewing options for how to fix it. The one obvious and significant mistake to avoid is electing to build a software capability without reviewing options to buy it. Just because vibe coding makes developing apps and AI agents easier doesn’t mean it’s a good idea for the business to own the solution and the costs of ongoing maintenance. Developers should also consider vibe no-coding, https://drive.starcio.com/2026/07/should-citizen-developers-vibe-code-or-vibe-no-code/ where AI generates an application on SaaS infrastructure and leverages its platform security and governance capabilities. Vibe coding creates new opportunities to accelerate software development, but failing to keep up with its speed, risks, and new complexities is a mistake devops teams can’t afford to make.