Claude, Lovable, and other AI tools make it easy to build an app in an afternoon. But turning that vibe-coded prototype into a real business tool requires engineering discipline that most AI-generated apps don’t have.
Every year brings a new “wow” moment in AI:
- 2022 — ChatGPT launches. You can have a real conversation with AI. 100 million people try it in two months.
- 2023 — GPT-4 passes the bar exam. AI stops being a toy.
- 2025 — Andrej Karpathy coins “vibe coding.” Non-developers start building apps with AI.
- 2025 (Oct) — Security firm VeraCode reports: AI-generated code got better at functionality, but security did not improve over three years.
- 2026 (Feb) — Karpathy declares vibe coding “passé,” coins “agentic engineering.”
Every one of these moments felt revolutionary. And they were — in what they let us do.
Robert C. Martin, known as Uncle Bob, a legendary software engineer, describes AI as just the next step on the ladder. Every generation of programming tools made things easier, from early machine code to modern languages like Python, and now to AI. Each step up, nothing else changed. The fundamentals still apply: you still need to test it, structure it, and make sure the pieces fit together.
And that’s exactly the point. The problem isn’t that AI builds bad software. The problem is that people skip the engineering discipline that every step on the ladder has always required. We can do certain things faster. We are amazed at how quickly we can create prototypes. And yes, they are great prototypes. Great for validating an idea. But in my view, they are not production-ready applications. Let me explain.
1. Your AI app is disconnected from your business ecosystem.
That’s the most critical aspect, in my opinion. You have something that looks great, but nothing more. It doesn’t talk to your CRM. It doesn’t sync with your accounting software. It doesn’t connect to the tools your team actually uses every day. Does it bring extra money to your business? What value does it bring to your system? If it’s not properly cared for, it will vanish as quickly as it appears on your screen. In my previous article, I wrote about vulnerabilities in AI-generated snippets. I stand by this; you don’t want to risk your money, reputation, and employees’ frustration because of it.
2. AI-generated code has serious security gaps.
At the time of writing, Anthropic has just released Claude Opus 4.7 — a model so capable that it found thousands of unknown security flaws in software that had been reviewed by humans for decades. Now think about your vibe-coded app. If decades-old, professionally built software has critical vulnerabilities, what does that say about an app generated in an afternoon? The AI models were trained on that same flawed software. What do you think the chances are that it builds something bug-free?
A 2025 study by VeraCode showed that while AI-generated code improved in functionality, its security did not. AI introduced well-known security vulnerabilities in 45% of test cases. In the same year, a security researcher found that 170 of 1,645 apps built by users on the Lovable platform had critical vulnerabilities exposing names, emails, and API keys. That’s roughly 1 in 10. The AI built the app, but nobody configured the database security.
Uncle Bob himself is bullish on AI. He trusts AI output so much that he doesn’t review the generated code at all. But that trust comes with a condition: he runs automated checks to catch bugs before they reach users, measures code quality against strict standards, and rejects anything that doesn’t meet those standards. Your vibe-coded app likely has none of that.
Your business data is at stake.
3. AI doesn’t build production infrastructure for you.
Does AI set up your hosting, monitoring, backups, and disaster recovery? Does it handle compliance? Does it ensure every update is tested before it reaches your users? If you have real users relying on your app, I wouldn’t trust AI to handle everything on its own.
There’s another layer to this. As Rahul Garg writes on Martin Fowler’s blog, AI conversations disappear. The decisions made while building your app vanish the moment the chat session ends. Three months later, when something breaks, nobody remembers why that feature works the way it does. The conversation that shaped it is gone. Without proper documentation, your app becomes a black box that nobody can fix or improve.
Anthropic themselves teach this in their AI Fluency framework — you need to define what to delegate to AI and what should stay in your control or with your trusted technical partner, who will bring organizational discipline to how you use AI, not just the AI itself. Would you give your production data credentials to AI? I wouldn’t advise that.
Should it scare you?
Don’t get me wrong. This is a great time we live in. At my company, we invest in AI with good reasoning and foundations. But first, we focus on delivering value and using a behavioural approach in development. You should do the same.
So go ahead, vibe code a prototype with Claude. Make your idea come true. Then bring in someone who will make it production-ready, with security, privacy, and reliability in mind.
If you already have a vibe-coded app and want to know where you stand, look for a code audit that gives you a clear picture of what’s solid and what needs fixing. And if you’re still shaping the idea, a discovery workshop is a good place to start, so you build on the right foundation from day one.
Let’s talk. Reach out to me directly or visit rocksoft.pl.
