AI Coding Reality Check: Three Stories From the Frontline

The discourse around AI coding tools has hit a strange inflection point. The initial euphoria is fading, and now comes the reckoning. Here are three stories from this week that show where things actually stand.

TL;DR: Vibe coding has a quality problem that Bram Cohen is calling out hard. AI is about to automate vulnerability discovery in ways that will reshape security research. And one developer spent eight years procrastinating on a SQLite devtools project, finally shipped it in three months with AI, then threw the whole thing away and rebuilt it properly.

Vibe Coding Has a Quality Problem

Bram Cohen, known for BitTorrent and Chia, published a sharp piece titled "The Cult Of Vibe Coding Is Insane". The short version: people are shipping genuinely bad software and calling it a feature.

The Claude source code leak gave everyone a peek behind the curtain. What they found was a codebase full of duplication, confusion between agents and tools, and all the hallmarks of code written without a human actually looking at it. Cohen's take is brutal and correct:

"You don't have to have poor quality software just because you're using AI for coding. People have bad quality software because they decide to have bad quality software."

His prescription is refreshingly simple. Don't fully delegate architecture decisions to AI. Do look under the hood. Use AI for the implementation grunt work after you've done the thinking. The vibe coders treating AI like a one-shot magic wand are producing exactly the mess you'd expect.

AI Is About to Rewrite Vulnerability Research

Thomas Ptacek published one of the most important security posts I've read this year: "Vulnerability Research Is Cooked". The title is not subtle.

Ptacek's argument is that coding agents are about to collapse the cost of finding zero-days to near zero. Not because they replace human researchers, but because they eliminate the biggest bottleneck: elite attention. A frontier model already encodes knowledge of bug classes, code patterns, and exploit techniques that took humans decades to accumulate. An agent will search forever without getting bored.

Nicholas Carlini at Anthropic ran a simple experiment. He wrote a 15-line bash script that asked Claude Code to find vulnerabilities in every file of a codebase. Then he asked the model to verify its own findings. The success rate was almost 100%.

This is not a future concern. It's happening now. The implications for how we build and defend software are significant.

Three Months With AI, Then a Rewrite

Lalit Maganti wrote the most honest post about AI-assisted development I've seen: "Eight years of wanting, three months of building with AI".

He wanted to build proper devtools for SQLite. For eight years he procrastinated because the work was hard and tedious: 400+ grammar rules, a parser that had to match SQLite exactly, no formal spec to work from. Then he tried vibe-coding the whole thing with Claude Code.

The first version worked. It produced a parser, a formatter, and 500+ tests. But the codebase was spaghetti. He didn't understand large parts of it. So he threw it away and rebuilt from scratch with a different approach: heavy human involvement in architecture, AI handles the implementation details.

The lesson is not that AI failed. It's that AI is great at implementation but bad at design decisions that have no objectively checkable answer. The second attempt took longer and required more human judgment, but produced something maintainable.

Sources: The Cult Of Vibe Coding Is Insane, Vulnerability Research Is Cooked, Eight years of wanting, three months of building with AI