What is vibe coding and why does it get so much hate?

The article highlights “vibe coding” (LLM-driven code generation) growing in popularity, but warns of security risk: Georgia Tech researchers traced 14 critical vulnerabilities to AI-generated code in a scan of 43,000 security advisories (with estimates of 5–10x more AI-generated issues likely). A survey of 1,100 professional programmers found 72% use AI coding tools daily and 42% of their codebase is AI-generated or assisted, with expectations that AI-generated code exceeds half of codebases by next year. Overall, the message is that productivity gains may come with higher vulnerability and maintainability risks, keeping sentiment cautiously negative.

Analysis

The investable read is not "AI helps developers"; it is that code volume and code risk are both rising faster than human review capacity. That shifts incremental spend toward application security, testing, provenance, and governance layers, which is why the cleaner beneficiaries are cybersecurity and code-quality vendors rather than broad software beta. Second-order, more AI-generated surface area also means more rework, support load, and cloud consumption, which quietly taxes gross margins for companies with large legacy codebases.

The first real catalyst is unlikely to be usage data; it will be an attributable incident, procurement requirement, or audit finding that forces enterprises to buy controls around AI-authored code. That is a 1-3 quarter story, not a same-day trade, and the risk is that current adoption remains mostly AI-assisted rather than fully autonomous, slowing the security spend impulse. Over 6-18 months, the bigger structural effect may be labor funnel collapse: fewer junior hires improves near-term productivity but eventually raises senior engineer scarcity and wages, a headwind for IT-services and staffing models.

Consensus is still treating this as a pure margin-expansion narrative for software. The market is underappreciating that productivity gains do not eliminate spending; they reallocate budget to review, remediation, and risk management. The thesis is falsified if enterprise AI coding adoption rises without any increase in defects, incidents, or compliance friction over the next two earnings cycles, or if vendors show that AI-assisted code quality is stabilizing faster than expected.

Key Decisions for Investors

• Long CIBR or CRWD on 5-10% pullbacks; 3-6 month horizon. Risk/reward is attractive if even a small fraction of AI-authored code forces incremental security spend; falsify on flat incident rates and no change in appsec budgets across the next two quarters.
• Pair trade: long CRWD / short EPAM over 6 months. The long leg captures security-gov spend; the short leg expresses pressure on labor-arbitrage and junior-heavy delivery models if hiring cuts persist. Cover if EPAM shows accelerating AI-led billable productivity without margin compression.
• Buy PANW Jan/Apr upside calls only if the next earnings cycle shows higher attach in code security or governance. This is a catalyst trade, not a momentum trade; avoid if management only reiterates generic platform growth.
• Watch list, not a trade yet: GLOB and EPAM. If management commentary shifts toward fewer entry-level hires and slower headcount growth, consider put spreads. If they instead show stable utilization and higher project throughput, the bearish labor thesis is wrong.