I Audit Vibe Coded Apps for CEOs. Here's What I Keep Finding

The speaker warns CEOs and non-technical users that AI coding tools often produce incomplete or faulty applications, emphasizing the need to treat AI outputs as plausible suggestions rather than guaranteed solutions. They recommend implementing formal delivery contracts with clear specifications, proof requirements, and independent verification to ensure AI-generated software is reliable, secure, and functional before production deployment.

The speaker addresses CEOs, product managers, and non-technical individuals who have started coding using AI tools like Claude Code or Codex, emphasizing that while it’s commendable to engage in coding, one should not blindly trust these AI agents. Many clients have spent significant resources on these tools only to end up with incomplete or faulty applications. The speaker highlights a common cycle where users believe that by prompting the AI more, they can achieve perfect results, but this often leads to wasted effort and unsatisfactory outcomes.

Through conducting Vibe Code audits for clients, the speaker has observed recurring issues in AI-generated applications. Typically, clients provide detailed specifications and receive working prototypes, but upon closer inspection, many critical features such as authentication, security, and testing are either missing or improperly implemented. Despite clients’ confidence that the AI has fulfilled all requirements, audits reveal broken workflows, lack of proper user authentication, and superficial tests that do not validate real functionality.

The root cause of these problems lies in the fundamental nature of AI agents, which operate as next-token predictors generating the most plausible output rather than guaranteed correct or aligned solutions. This means that even if an AI claims to have implemented a feature, it might not have done so correctly or completely, especially if it lacks access to the necessary environment or tools to verify its work. Therefore, outputs from AI coding agents should be treated as plausible suggestions rather than definitive solutions.

To address these challenges, the speaker proposes treating AI agents like untrusted contractors bound by formal delivery contracts. These contracts should clearly define the agreed deliverables, constraints on what the AI should not do, and require proof artifacts demonstrating that the work meets the specifications. Additionally, verification must be conducted independently of the AI, either manually or through automated tools, to confirm that the delivered features function as intended. Ownership of tasks should be assigned either to the AI or humans based on the nature of the work and risk considerations.

In conclusion, the speaker advocates for a structured approach to moving AI-generated proof-of-concept applications into production. By implementing delivery contracts with clear terms, proof requirements, and verification processes, CEOs and product managers can ensure that AI-assisted development produces reliable, secure, and functional software. This methodical framework helps avoid the pitfalls of over-reliance on AI agents and establishes accountability, ultimately leading to successful deployment of applications built with AI coding tools.