Vibe Coding Is the New Open Source—in the Worst Way Possible

Summary

The article examines the rise of “vibe coding”—developers leaning on AI to generate plug-and-play code—and how it echoes the efficiencies and dangers of past reliance on open source. WIRED warns that AI-generated code can reintroduce old vulnerabilities, create new ones, and fragment accountability because it lacks the transparent provenance that traditional source-control workflows provide.

Key contributors quoted include security experts from Edera and Checkmarx, who highlight problems such as insecure training data, inconsistent outputs from the same model, poor traceability of authorship, and low adoption of approved tooling. A Checkmarx survey cited in the piece found many organisations already rely heavily on AI-generated code, but few have formal controls in place.

Author style: Punchy — this is a sharp, urgent briefing: treat it like a security alarm, not a gadget demo.

Key Points

Vibe coding lets developers spin up AI-generated code quickly, similar to how they reuse open source libraries.
AI can reintroduce known vulnerabilities if trained on insecure or outdated codebases.
AI-generated code lacks the same provenance and accountability found in open-source repos (pull requests, commit history).
Outputs from the same large language model can vary between developers, increasing inconsistency and review burden.
Checkmarx survey: a third of security and dev leaders reported >60% of their organisation’s code was AI-generated in 2024, but only 18% had an approved-tools list for vibe coding.
Vibe coding risks disproportionately affect small businesses and vulnerable groups who adopt low-cost AI solutions without robust security safeguards.
Organisations should apply software-supply-chain lessons from open source—lifecycle controls, approved tooling, and stronger auditing—to AI-generated code.

Context and Relevance

This piece matters because it connects two major trends: the rapid uptake of AI-assisted development and ongoing software-supply-chain insecurity. For developers, security teams and decision-makers, it highlights an urgent gap between practice and governance—many teams already embed AI code into products without equivalent processes for traceability, approval and review.

As enterprises and smaller teams adopt local models and automated code generation, the same challenges that once plagued open-source dependencies (hidden vulnerabilities, malicious takeover, outdated components) are resurfacing in a less transparent form. The article situates vibe coding as the next frontier where supply-chain risk will crop up unless organisations update development lifecycles and tooling.

Why should I read this?

Because if you build, buy or run software, this is where the next set of painful breaches and costly bugs will start — and most teams aren’t ready. Read it now to get the short, sharp take on what to watch for: provenance gaps, inconsistent outputs, and the urgent need for approved tooling and lifecycle checks. Seriously, it’s worth the five-minute read if you care about not inheriting someone else’s security debt.

Source

Source: https://www.wired.com/story/vibe-coding-is-the-new-open-source/