Vibe coding is no longer a fringe experiment—it’s becoming standard practice across teams and organizations looking to move faster with less friction. But as adoption grows, so does a quieter, more dangerous problem: what happens when AI-generated code accumulates across critical systems and no one truly owns it?

The second part of the mini-series, Vibe Coding: The Good, The Bad, and The Ugly, explored how that lack of ownership created maintainability issues and hidden technical debt for Rightwave. Now, in the third part, we’re going further—into the territory where those unresolved risks stopped being an inconvenience and started becoming a liability.

Vibe Coding: The Ugly — Security, Risk, and When It Hits the Fan

The risks of AI-generated code become far more serious when those systems start powering critical business functions. What began at Rightwave as a productivity advantage had, over time, evolved into something harder to see—and harder to control.

Organizations in similar positions are now facing a growing set of concerns:

• Security vulnerabilities and compliance gaps
• Increased attack surface
• Real-world risks like outages, breaches, and data exposure
• Lack of governance over AI-generated systems

At this stage, the conversation is no longer about speed — it’s about risk.

The Breaking Point

For Rightwave, the turning point came suddenly.

A customer-facing outage brought key systems offline. Transactions failed. Users were locked out. Support tickets surged within minutes.

What began as a performance issue quickly escalated into a full-scale incident, with several teams scrambling to diagnose the problem.

Where was the failure coming from? What had changed? What system—or combination of systems—was responsible?

The answers weren’t immediately clear.

Tracing the Problem Back

After hours of investigation, the team isolated the issue. It traced back to an AI-generated component—one that had passed initial testing but had never been fully reviewed for downstream impacts.

On its own, the change seemed harmless but when combined with other interconnected systems, many of which had also been generated or modified using AI, it created a cascading failure.

The problem wasn’t just the bug — it was the lack of visibility into how everything fit together.

The Illusion of “It Works”

This is where AI-generated code introduces a unique kind of risk. It often looks complete and functions correctly—at first. However, without thorough validation, governance, and review, critical gaps can remain hidden:

• Edge cases that were never tested
• Security controls that were never enforced
• Dependencies that were never fully understood

At Rightwave, these gaps had quietly accumulated over time. The outage didn’t create the problem — rather, it exposed it.

A Broader Security Concern

As the investigation continued, a larger issue came into focus — security practices across systems were inconsistent. Some components followed internal standards. Others, especially those rapidly generated with AI, did not.

• Authentication logic varied between applications
• Input validation was uneven
• Logging and monitoring were incomplete
• Documentation was missing or outdated

Individually, none of these gaps had triggered alarms. Collectively, they created a significantly expanded attack surface. One which, under the wrong circumstances, could lead to far more than an outage.

A Different Message to the Board

Months later, standing in front of the board again, CEO Mark Clive delivered a different message than the one he had months earlier.

“AI made our developers faster,” he said. “It didn’t replace the need for developers.”

The initial success hadn’t been wrong — but it had been incomplete.

AI wasn’t a substitute for engineering, it was a multiplier; and without the right foundation in place, it had amplified both speed and risk.

Stabilizing the Environment

To regain control, Rightwave took a step back. They partnered more deeply with Programmers.ai, bringing in experienced developers to work alongside their internal team. The focus shifted from speed alone to sustainability:

• Reviewing and hardening AI-generated code
• Standardizing security practices
• Reducing accumulated technical debt
• Reintroducing documentation and governance processes

The tools didn’t change, but the approach did. Rightwave’s teams continued using ChatGPT and Claude Code, but rather than being treated as an endpoint, AI became part of a structured and disciplined development process.

The New Reality

Rightwave didn’t abandon AI-generated development — they learned how to manage it. That’s where many organizations are finding themselves today.

AI-generated code is here to stay. The question is whether it operates:

• As a controlled, well-understood asset

or

• As an unmanaged risk embedded deep inside critical systems

Takeaway

Without proper oversight, AI-generated code can introduce serious business risk. What begins as acceleration can quickly evolve into instability, vulnerability, and loss of control.

The organizations that succeed won’t choose between AI and engineering expertise — they’ll combine them. Because faster code is easy — trustworthy, secure, and scalable systems are not.

If you’re navigating similar challenges or starting to notice the early signs, we’d love to compare notes. We have been working alongside organizations through exactly these kinds of transitions, and there’s a lot we can learn from each other. Reach out here if you want to talk through what you’re seeing.