AI writes the code now. Almost nobody reads it.

The unsettling thing about the vibe-coding security problem is that the code usually works. It compiles, it passes the demo, the screenshots look finished. What it doesn't do — until someone actually checks — is hold up the first time a real user, or a real attacker, wanders off the happy path.

For two years the story of vibe coding was pure speed: describe what you want, watch it appear, ship by dinner. In 2026 the bill for that speed came due, and it has a name the security world has started using without irony — security debt. The code got faster to write and no easier to trust, and the numbers are finally big enough that buyers, sellers, and platforms can't wave them away.

The numbersHow big the problem actually got

The headline study came from Veracode, which ran more than a hundred large language models through security-sensitive coding tasks. The models wrote code that compiled almost every time — and failed a security test about 45% of the time, introducing a flaw from the OWASP Top 10. Two years of newer, smarter models barely moved that number: syntax pass rates sailed past 95% while the security pass rate sat stuck near 55%.

The category breakdown is worse than the average lets on: in the same testing, the vast majority of samples failed to defend against cross-site scripting, and a similar share were open to log injection. Other 2026 analyses put the "ships with at least one vulnerability" figure even higher — north of 60% — depending on language and task. Java fared worst; the languages models have seen the most insecure examples of, they reproduce the most insecurely.

And it scales with productivity. One study across large enterprises found AI-assisted developers merging code three to four times faster than their peers — while introducing security findings at roughly ten times the rate. More code, faster, with fewer eyes on it. That is not a rounding error; it's a structural shift in how much unreviewed code exists in the world.

Why it happensThe step that quietly got skipped

None of this means the models are bad. It means they're optimized for the wrong finish line. A language model is rewarded for producing code that looks right and runs — that's what its training and your prompt both ask for. "Runs" and "is safe" are different properties, and only one of them shows up in a demo.

In the old workflow, the gap between those two was covered by a human: someone read the diff, someone asked "wait, is that input sanitized?", someone insisted on a review before merge. Vibe coding is fast precisely because it collapses that loop — you accept the suggestion and move on. The speed is real. So is the thing that got removed. The review didn't get automated; for a lot of shipped software in 2026, it simply stopped happening.

The demo proves it runs. It's the code that tells you whether it's safe to own.

The fixGuardrail agents: a second AI that only audits

The most interesting 2026 trend isn't a new way to write code faster — it's a new way to check it. The pattern spreading fastest is the guardrail agent: a second model whose entire job is to review what the first one produced, flagging injection risks, leaked secrets, missing auth, and unsafe defaults before any of it ships. Generate, then verify — with the verifier as suspicious of the generator as a good reviewer would be.

Early evidence says the split works. When testers put code through agentic review pipelines instead of trusting raw model output, the exploitable SQL-injection and cross-site-scripting bugs that plagued direct generation largely disappeared. The lesson mirrors the one everyone eventually learns about AI: a single model asked to do everything at once is unreliable; the same model, given one narrow job and something to check against, is much better. Writing and reviewing were always two jobs. Vibe coding briefly pretended they were one.

If you sellClean code just became a selling point

Here's where the trend stops being abstract. If you've built something small and you're thinking about selling it, 2026 changed what a buyer assumes when they hear "vibe-coded." They assume speed — and they assume it might not have been reviewed. That assumption is now priced in.

Which means the reverse is a real advantage. A project whose code is clean, whose secrets aren't hardcoded, whose obvious holes have been closed — that's no longer table stakes, it's a differentiator you can point to. The tool that wrote your project doesn't lower its value; the state of the code sets the price. Run a guardrail pass before you list, and you're selling something a buyer can trust on inspection rather than on faith.

If you buyReading the code is the new due diligence

And if you're on the buying side, the whole story collapses into one rule: don't buy the demo, buy the code. A working screen recording proves the happy path runs. It tells you nothing about whether the thing is secure, original, or maintainable — the exact properties the 45% number is about. In a world where most software is written fast and reviewed rarely, the buyer who actually reads the source has an enormous edge over the one who trusts the pitch.

That's the reason every listing on Vertos ships with a free AI Analysis of the actual source code — not the seller's description, the real repository. You see what the project is genuinely built from before you commit a cent, which is the closest thing there is to running a guardrail agent on something before you own it. Careful diligence still matters, but you start from facts instead of a screenshot.

What to do about itThree things you can act on this week

• If you vibe-code, add a verifier. Before you ship, put the diff through a security-focused pass — a scanner, a linter, or a second model told to only hunt for flaws. Treat AI-written code as unreviewed until something has actually looked for the holes.
• If you're selling, clean it first. A guardrail pass before you list turns "trust me" into "check it yourself." Clean, reviewed code is now a price signal, not a nicety.
• If you're buying, read the source. Never wire money on the strength of a demo. Use a marketplace that shows you the real code — on Vertos, that's a free AI Analysis on every listing — and buy on evidence.

More small, working software exists now than at any moment in history, and most of it was written faster than it was ever read. The projects with a clear job and a clean codebase are real assets — they just live in a market that has finally learned to check under the hood before it pays.

The best software has always been the kind someone actually read. That part never got automated.
— The Vertos team