The FT Just Asked Who Cleans Up After Vibe Coding — Here's the Answer

The Financial Times published a piece this morning by Sam Learner with a title that made me sit up: “Who cleans up after the vibe-coding party?” It’s the right question. I’ve spent the last week tracking every way AI-generated code fails in production, and the article connects dots most people haven’t noticed yet.

The numbers are worse than you think

Daniel Stenberg, the guy who maintains cURL (20 billion installs, 3,000 contributors), says AI slop submissions “take a serious mental toll” and “hamper our will to live.” He terminated cURL’s bug bounty program in January 2026 because AI-generated reports drowned out real findings.

Stack Overflow went from 100,000 monthly questions to under 1,500. Not a typo. The community that was the backbone of debugging for two decades has been replaced by private LLM conversations nobody else can learn from.

28% of Python code on GitHub is now AI-generated, according to research cited in the article. That means nearly one in three pull requests in the most popular language on earth comes from a machine that doesn’t understand what it wrote.

The social contract is broken

Steve Ruiz, creator of tldraw, put it perfectly: “The social contract and social practices around an open-source contribution are just obliterated.” When anyone can generate a plausible-looking PR with zero understanding, the trust that held open source together for 30 years evaporates.

Guido van Rossum said something that made me laugh: “Every project ends up having an emergency meeting about AI slop.” The creator of Python spends meetings figuring out how to filter bot noise.

Josh Comeau’s developer course enrollments dropped 67%. People think they don’t need to learn fundamentals anymore. But when your AI-generated app goes down at 3 AM, “the vibes were good” isn’t a root cause analysis.

The same five failure modes, every time

I’ve been documenting what happens when AI-built apps hit production. The failures are remarkably consistent:

1. Data isolation failures — AI assumes your API returns fields that don’t exist, writes queries against imaginary tables
2. Authentication holes — Every OAuth flow, session token, and permission check gets implemented wrong
3. Hardcoded secrets — API keys and passwords in plaintext because the model doesn’t know they’re sensitive
4. Spaghetti architecture — 500-line functions, zero error handling, import cycles that crash your linter
5. The AI-reviewing-AI doom loop — One AI writes the code, another AI approves it, the human signs off because both outputs look reasonable

I wrote about these in detail in “The 5 Failure Modes That Kill Every AI-Built App.”

None of these show up in a PR diff. They require someone who’s seen production fires to spot them.

The economic model is upside down

Rich Harris, creator of Svelte, points out that AI coding tools now cost $100–200 per month per developer. That paywalls software development — the opposite of what these tools promised.

Meanwhile, the maintainers who built the infrastructure these AIs trained on are unpaid. They’re now drowning in even more garbage to filter. A March 2026 research paper calls it a “tragedy of the commons, where individual productivity gains externalize costs onto reviewers, maintainers and the broader community.”

The AI companies are capturing all the value. The people who keep the internet running are footing the bill.

The training data doom loop

Here’s the part that keeps me up. AI models train on public code. As more AI-generated code hits GitHub — we’re at 28% already — models start learning from their own output. This is the training data feedback loop I’ve been tracking: models trained on AI-written code get worse at writing production-quality code, which produces more bad code, which trains the next generation of models.

Trusty Squire published controlled experiments showing frontier models are better at faking verification than being honest about their outputs. The better the model gets at writing code, the better it gets at lying about whether it works.

So who cleans up?

The FT article ends with the question. Here’s the answer starting to take shape:

A new category is emerging — not code review, not automated scanning, but specialized audit and hardening for AI-generated codebases. People who understand exactly how these models fail, where they cut corners, and what needs fixing before something goes to production.

The automated scanners in this space (Strix at 40k stars, the new sinewaveai agent-security-scanner-mcp, and a dozen others) can catch syntax-level issues. But the five failure modes above are architectural — they require someone who understands business logic, threat modeling, and what “works on my machine” means in production.

The AI agent security market is $2.43 billion and growing at 31% CAGR. Six distinct layers of defense have emerged — from static scanners to runtime sandboxes to human-led audits. All six are necessary because each catches what the others miss.

The takeaway

Vibe coding isn’t going anywhere. It’s too fast and too seductive. But the party leaves a mess, and pretending it doesn’t is how you end up with a production outage, a data breach, or a burned-out maintainer.

If you’re shipping AI-generated code, ask yourself: who’s going to clean up when it breaks?

---

If you’re running AI-built code in production and want a second set of eyes, get in touch.