‘Vibe coding’ makes designing apps easier than before — but it comes with risks

Cyanide ice cream. Cholera-inspired chocolate cake. A recipe featuring so-called ingredients the CBC’s Language Guide discourages from repeating verbatim.

These can all be found on RecipeNinja.AI, a website created by U.S.-based tech entrepreneur Tom Blomfield that uses artificial intelligence to generate recipes after a user suggests a list of ingredients.

“Some more mischievous users started to push the envelope on what kind of recipes his AI-powered site would generate. And they found that it would generate things that they thought were funny but are potentially dangerous,” Emanuel Maiberg, a reporter for the tech website 404, told The Current host Matt Galloway.

Blomfield built RecipeNinja.AI with a new method recently dubbed “vibe coding,” where people use AI tools to build a program, app or game with prompts or suggestions much like how one would use ChatGPT to generate a written text answer.

But the RecipeNinja.AI example calls attention to how building apps solely by “vibe” may lead to problematic, and even potentially dangerous results.

Since Maiberg’s story was published on April 2, the cyanide ice cream article has been removed from RecipeNinja.AI’s archive, but others including the cholera cake remain. CBC reached out to Blomfield for comment, but did not receive a reply.

Vibe coding was coined by Andrej Karpathy, a Canadian computer scientist and co-founder of artificial intelligence giant OpenAI, in a 2023 post on X.

“There’s a new kind of coding I call ‘vibe coding,’ where you fully give in to the vibes, embrace exponentials, and forget that the code even exists,” Karpathy wrote, as though describing something more akin to a meditation session than developing a computer program.

Vibe coding has become possible recently, experts say, because AI tools have become sophisticated enough to build functional — or mostly functional — apps with little more than general prompts or suggestions.

“The difference between last year and now is that large language models — LLMs — have gotten good enough that they can actually produce, you know, medium-scale games or apps, things like that. It actually works,” said Michael Guerzhoy, an assistant professor teaching programming and machine intelligence at the University of Toronto.

The process has opened doors for budding app makers like Chioma Janelle Efejedia, a psychotherapist and social worker based in Kitchener, Ont.

Not knowing how to code, she might have had to pay a programmer thousands of dollars to make a mental health app. Instead, she vibe-coded her own app called OMA Life, which offers guided mindfulness in various languages including Ibo, Yoruba, and Urdu, culturally relatable relaxation sounds, and access to a directory of therapists.

“I just think, you know, where tech is right now gives a great opportunity to say, OK, I can meet this need,” Efejedia told CBC Radio’s Manjula Selvarajah.

‘Build something really cool’

Tobin South, a researcher in AI security at the Massachusetts Institute of Technology, says he’s excited by vibe coding’s “ability to unlock your everyday person to build something really cool.” 

“I went to a party the other day and someone wanted a really cool app to organize the party. And so I made a little app with bingo cards inside of it, and a party agenda. And I was able to just bring this into existence with the English language rather than typing any code,” he said.

But he also cautions that it can create “massive security risks” when they aren’t written and checked by experts in the field.

“If you’re starting to build personal finance tools or other tools to augment your life, these things can get really tricky. You do not want your bank details leaked all over the internet because you vibe coded,” he said as an example to Galloway.

He likened traditional app building as something made out of Lego bricks by trained experts, brick by brick, drawing on the work and experience of previous versions and notes from their creators.

Vibe coding, meanwhile, is sort of like dumping your hand blindly into a box of bricks and making something out of whatever you’ve clawed out.

“Sometimes … this leads to a Lego construction, a Lego house that might fall down, that’s missing some essential bricks that hold it all together,” he said.

‘Unexpected, dangerous results’

Someone vibe coding on their own won’t benefit from the institutional knowledge of working in a tech corporation, either.

“If you work at Google, there’s already someone breathing down your neck about security and making sure everything’s done the right way,” South said.

In other words, if you make a recipe app without vibe coding, there’s almost certainly someone on your team making sure that if someone asks for a recipe with cyanide, it won’t actually go ahead and make one.

In late 2024, Google CEO Sundar Pichai said that 25 per cent of all new code for the company’s products were made with AI, though under the supervision of human employees.

Maiberg cautions that as more programmers — not just amateurs or hobbyists like Efejedia — use AI to build their code and programs, more lines of code that have never been checked by a human may creep into our collective technological backdrop.

That could mean errors might never be found until the consequences rear their ugly head — from a rude ice cream recipe, to easily hackable personal banking info to something worse we may have yet to predict.

“I think my concern, and the concern of other people, is that we can get unexpected, dangerous results from having so much code written by AI in a way that we don’t fully understand,” Maiberg said. 

“Increasingly, code is going to be written by AI and not humans. And AI is prone to error, and that’s the risk.”