Vibe slop in coding: A guide for IT executives

What is vibe slop?

The concept of AI slop has been growing in recent years to describe the high-volume, low-quality nature of some AI-generated content.

Vibe slop can be thought of as a specific flavor of AI slop, that is, the result of low-quality AI-generated code. The code runs without errors, and, to the untrained eye, it might look fine. The reality is that the vibe slop code was never subjected to review, testing and architectural thinking that separates working code from production-ready code.

The most dangerous cases are not the ones that crash. Joshua Copeland, professor at Tulane University and director of cybersecurity at Crescendo AI, has seen AI-generated code pass every test and still miss the point.

"In these situations, the code executes successfully but solves a problem different from the organization's intent," Copeland said. "Such defects are often more hazardous than outright failures because they can persist undetected in production."

Risks of vibe slop

The risks associated with vibe slop are more specific than just plain generic AI slop. These risk categories can also compound. An unreviewed vulnerability becomes technical debt, and unmeasured debt becomes an operational blind spot.

AI code security vulnerabilities

AI models can suggest insecure coding patterns such as hardcoded credentials, authentication shortcuts and unvalidated inputs that could lead to SQL injection risks.

Secure Code Warrior's AI Trust Index, built with RMIT University in Australia, evaluated 1,760 AI-generated codebases across 16 models. It found an average of 15 vulnerabilities per codebase, clustered mainly around logging failures, injection flaws, insecure design and broken access control. That last category is what one CIO ran into directly.

"One example was code that had bypassed an existing authentication pattern because AI created a simplified implementation," said Ha Hoang, CIO at Commvault, a data management protection company. "It passed initial testing but failed security review because it ignored pre-established access controls. It only took a day or two to identify because we have security and architecture reviews built into our process."

Technical debt explosion

Vibe slop tends to make technical debt issues worse as AI-generated code piles up faster than teams can review it.

"The metrics I have teams track are review latency, defect escape rate into production and the percentage of merged code with a named human accountable for it -- when that last number drops, debt is compounding silently," said Nick Shevelyov, founder of vCSO.ai and former chief security officer, chief privacy officer and CIO of Silicon Valley Bank. "Code shipped at machine speed without validation isn't throughput; it's unvalidated inventory moved onto the balance sheet as a liability."

Sudheer Mareddi, senior vice president and head of global delivery for digital engineering services at Sutherland, saw the same pattern. "We also saw new forms of technical debt, including duplicated logic, inconsistent design patterns, and unnecessary abstractions," he said.

System reliability and performance

AI-generated code is typically validated against the concept commonly known as the happy path. That's the everyday scenario where if nothing goes wrong on the initial run, that's good enough. Common application failures, such as concurrency issues, resource leaks and edge cases, go untested until they surface under real load.

Amazon saw this in March 2026, when AI-assisted code changes contributed to two outages at its retail site within a week, according to internal documents reported by Business Insider. One caused 120,000 lost orders and 1.6 million website errors. The other caused an estimated 6.3 million lost orders.

The metrics I have teams track are review latency, defect escape rate into production and the percentage of merged code with a named human accountable for it -- when that last number drops, debt is compounding silently.

Intellectual property and licensing risks

AI models trained in public repositories can potentially create legal issues. Doe v. GitHub, a 2022 lawsuit alleging Copilot's outputs strip copyright management information required under federal law, is awaiting a Ninth Circuit ruling after oral arguments in February 2026.

Compliance and regulatory exposure

AI-generated code can also introduce regulatory compliance risks. Vibe coding tools can embed GDPR, HIPAA or PCI-DSS violations without anyone flagging them as compliance issues.

"Not automating controls for regulatory frameworks will create chaos in the next compliance cycle," said John-Paul Herold, vice president of engineering at Sembi, a software quality management company.

Loss of engineering excellence

Too much vibe coding can erode developers' problem-solving skills. Additionally, codebases built from inconsistent AI output are harder for new hires to learn.

"The risk is real, particularly for junior engineers. AI can accelerate coding, but it cannot replace engineering judgment," Mareddi said. "The first skill to erode is diagnosis, not coding."

Operational blind spots

AI-generated code can create systems nobody fully understands, slowing incident response when something breaks. At Pearl, CTO JP Beaudry watched an AI code reviewer approve a change that reduced lead delivery to certain experts from five per day to two, breaking a contractual guarantee.

"While the AI flagged smaller issues in the code, including race conditions, naming issues and null safety, it had no knowledge that five leads per day was a contractual commitment, so it missed the defect that mattered most," he said.

Action steps for IT executives

Vibe coding does not inherently always lead to vibe slop. There are steps that can be taken to reduce the risk and improve the overall quality and practical utility of AI-generated code, so it's not just slop.

• Establish AI coding governance. Just like any other tool, it is important to have governance. Set policies for approved tools, require security scanning before production and hold developers accountable for every line they commit. "AI-generated code should be regarded as untrusted third-party input rather than completed engineering work," Copeland said. "Each implementation should have a designated human owner who is responsible for explaining, defending, testing, and maintaining the code."
• Audit AI tool usage. It's also critical to survey teams to find every AI coding tool in use before writing policy around them. "The newer wrinkle is that most teams have no visibility into what their AI coding agents can reach and wiring them in through things like MCP opens a new attack surface," George Gerchow, chief security officer at Bedrock Data, said. Governing starts with knowing what's there. "You cannot govern what you cannot see the agent reaching," he added.
• Implement enhanced code review protocols. AI code review best practices start with treating all code the same, whether it's written by a human or AI. "We don't treat AI-generated code differently once it's submitted, but we do require increased transparency on how it's produced," Hoang said. "The engineers remain responsible for every line of code, whether it was created by them or suggested by an AI tool." She added that AI tools shouldn't shorten the governance process.
• Deploy automated quality gates. A common best practice in DevOps is to have automated checks as part of the CI/CD process for software development and deployment. That same best practice must be in place for AI-generated code.
• Build AI-assisted development standards. Hoang noted that her team's AI-assisted development standards include guidelines on which AI agents are approved for use and on safe prompt practices to prevent the transmission of sensitive data to public models.
• Invest in developer training. Beaudry has been working with his engineering staff to deliver a series of mandatory training sessions on agentic coding and an optional weekly peer-led 'How I AI' session to share AI techniques. "Additionally, we provide dashboards for employees to take ownership of their usage by tracking license and token costs, " Beaudry said. "We think of this like using sunlight as a disinfectant, shining a light on usage to help engineers make informed decisions instead of pushing them into tokenmaxxing."
• Enhance testing infrastructure. Testing is the bottleneck the CloudBees report identified, with 70% of leaders calling test-suite maintenance a heavier lift than writing code.
• Create technical debt monitoring. Track metrics beyond just lines of code. One specific type of metric that Copeland suggests is cyclomatic complexity, which is the number of distinct logical paths through a function, which tends to run higher in AI-generated code than in code written by an experienced engineer.
• Architect for AI-human collaboration. The overall development workflow should encourage collaboration between AI tools and humans. "What works, review rotations where seniors interrogate AI-authored diffs and periodic exercises where engineers must explain what a generated module actually does before it ships," Shevelyov said. "Teams that never do this are outsourcing judgment, not labor."
• Vendor and tool strategy. Choosing an AI coding vendor takes more than comparing model benchmarks. "When evaluating AI vendors, we look beyond model quality to categories like IP protection, data security, auditability, deployment flexibility and integration with enterprise engineering standards," Mareddi said.
• Build organizational resilience. Maintaining human expertise and building organizational resilience means deliberately practicing without AI, not just reviewing what it produces. "Regular AI-free exercises, structured code walkthroughs, pair programming and reviews that emphasize reasoning over syntax can help preserve these essential skills," Copeland said.
• Evolve engineering culture. Rewarding architectural thinking and mentoring, not just shipping speed, keeps that habit alive. "The issue isn't that AI writes code, it's when engineers stop asking why it works," Hoang said.

Sean Michael Kerner is an IT consultant, technology enthusiast and tinkerer. He has pulled Token Ring, configured NetWare and been known to compile his own Linux kernel. He consults with industry and media organizations on technology issues.