DEV Community: Ruben Arevalo

The Vibe Coding Hate Is Justified. For All The Wrong Reasons

Ruben Arevalo — Sat, 27 Jun 2026 15:07:18 +0000

Vibe coding's critics are loud and vocal about their opinions, and they're right.

Their reasoning, however, is completely wrong.

Ever since the introduction of OpenAI's ChatGPT in November 2022, followed by releases from Meta, Anthropic, and Google for their initial Llama, Claude, and Gemini models in February, March, and December of 2023, respectively, people have been utilizing it in any way they can dream of, which has allowed its adoption to spread quickly within 2 to 3 years of its original release.

These AI models are really useful in helping speed our productivity. Whether it's asking it for home decor ideas, looking for clarification on how to solve a calculus problem via different approaches, or developing a full product without the need to put in the hard work that is usually required for it, it has made a significant impact not just worldwide, but especially in the tech industry.

But that's where the incorrect reasoning starts to form amongst the critics who are pushing a valid point on why vibe coding should not be encouraged.

In February 2025, AI researcher and software engineer Andrej Karpathy described a habit where he utilized AI-generated code, which he attributes to giving into the "vibes" associated with development while forgetting one crucial task: checking the code itself. He connected this to what he labels as "throwaway weekend projects", projects that are made for practice, for fun, or as a prototype for a bigger project.

Karpathy makes a valid argument that vibe coding is harmless if it's isolated and stays within small projects that don't truly go to production to actual consumers. However, what he does not account for is the person who does the actual vibe coding.

There are people in the tech industry who have worked for more than 10+, 20+, 30+ years, and some of them have embraced AI to help speed up the software development lifecycle, especially as projects become more ambitious and have tighter deadlines. Because of their long-term experience, these individuals either consciously or unconsciously use the training they had to gather before the generative AI area to make decisions before utilizing AI-generated code, walking the fine line between risk and reward.

Karpathy is one of those individuals. He has been studying and working in the tech industry for the past 20 years overall. This is shown by his work at Stanford University as a PhD student, becoming one of the founding members of OpenAI in 2015, spending 5 years as the Director of AI at Tesla, briefly returning to OpenAI, and eventually focusing on making YouTube videos, educating his audience about LLMs (large language models).

However, people who have no training and/or experience working in production environments involving multiple users, clients, and/or stakeholders have a higher risk in terms of liability. Of course, the opposite is also true, as experienced individuals could repeat the same patterns as an inexperienced software engineer and vice versa.

For example, between late January 2026 and early February 2026, Moltbook, a Reddit-style social network where AI agents post and chat with other AI agents, had its database completely exposed. According to Wiz.Io's analysis and findings, they found millions of authentication tokens (approximately 1.5 million) and thousands of email addresses (approximately 35,000).

After the Moltbook team patched the exposure within 3 hours of the report being made, the founder, Matt Schlicht, publicly stated on X that he didn't write a single line of code, defending his choice by stating that it was the "golden ages" and that AI should be allowed to prosper.

A second notable instance involving a similar incident as a result of vibe coding occurred back in April 2026. Lovable, a vibe coding platform that allows users, even those that are not in the tech industry, to build production grade full-stack applications using just AI prompts had a breach in their database that was reported by a security researcher going under the pseudonym, @weezerOSINT. They reported to the team that there was a mass data breach that was affecting every project created within their platform before November 2025. It was discovered that as a result, anyone could access the source code of users' projects, and read other sensitive information, such as database credentials. This marked a third major incident in just over a year, with the first occurring from March 2025 to May 2025, and the second occurring in February 2026, which exposed 18,000+ user records pertaining to major institutions such as UC Berkeley and UC Davis, along with K-12 schools who used the software to make exam questions.

Third, this is coming from my own experience as a software developer who has worked with an actual software that has multiple clients, customers, and staff management. Back in September 2025, I was working on this same software for a client, and I was working with a junior developer when an incident occurred that same month. This junior developer was a brilliant up-and-coming software engineer who was on the brink of graduating with his bachelor's degree in computer science. He was ambitious, very smart, and was hungry for getting things done quickly and efficiently.

However, quickly is what cost him in this case.

While I was working on maintaining a module in the software that I was in charge of, I noticed that he was moving too fast and asked him what he was doing. He claimed that he was working on a form for a client, but unfortunately, as much as I hate having to point out his lack of professionalism, his response certainly demonstrated both attitude and hurriedness. While this was happening, I observed that he was using AI to generate code for a change he was making to one of the pages. He made the changes and pushed them to production. However, I realized too late that the changes he made were in the login page file, not the file he was supposed to be working on for the client's form.

After I reviewed his code and realized what he had done, I firmly gave him 15 minutes to fix his error before escalating it to our supervisors. He attempted to push back, but I reiterated my point. He went ahead and got it done within 10 minutes thanks to a backup, but unfortunately, the damage had already been done.

That's when the realization hit me. While typing code forces you to focus on your coding environment, prompting an AI to do it for you will remove that focus entirely. In other words, you can accept a suggestion without verifying the file or directory it was actually included on, especially if you're not familiar with how programming works.

Despite being an up-and-coming software developer who wanted to learn everything he needed to know, the use of AI coding tools, such as Copilot, and Claude had quietly removed the one critical habit that required him checking both the code and the file it's being distributed in before deploying it to production, thus eliminating any safety nets that were remaining at this point. It was not because he stopped caring, but because placing his trust in a tool that a lot of people depend on today made him more relaxed in his approach. In other words, he got too comfortable.

These three examples (the Moltbook breach, the Lovable breach, and my anecdote) all point back to my earlier argument about the person who does the actual vibe coding. If the person using the AI-generated code has experience, they are expected to do a thorough code review to ensure that no vulnerabilities and other bugs arise while simultaneously applying their training to patch them. However, if the person has no experience or very little experience and/or little awareness of how these tools can have a significant impact that can go either way, there is a higher risk for liability and fallout.

That was the case for the junior developer I was mentoring at the time, who departed next month for reasons that were not related to the login page takedown, and for the companies who experienced database breaches or were at high risk for experiencing one.

Which all points to my original argument. Yes, vibe coding is hated for a reason, and I agree that it is justified. Look at the three incidents and the impact they had. Critics say AI and vibe coding make people careless. However, critics are wrong in their reasoning. It's very easy to blame hiring processes, code review culture, and mentorship since this was the norm before AI entered the picture.

But ultimately it was the person's dependency on it that got them too comfortable, and that's what cost them. Comfort is not something that can be afforded when the stakes are high, especially when a product impacts customers not just financially, but also personally.

Agentic AI: Who's responsible? The AI? Or the developer?

Ruben Arevalo — Sat, 20 Jun 2026 22:01:46 +0000

This week, while I was having lunch, I overheard someone talking about the incident that happened in July 2025 where a Florida mother was coerced into paying $15,000 after an AI cloned her daughter's voice in a way that made it sound like she was in danger.

Immediately, I remembered the article I wrote the previous week about how agentic AI has impacted our decision-making processes.

However, this person who brought up the topic asked a very good question:

Who's truly responsible for the decisions AI makes? The AI itself? Or the developer who made it?

The truth is that it entirely depends on the circumstances that led to the development of the AI, what happened throughout the development process (i.e. if any guardrails were added), and the impact it has had on the individuals using it.

But overall, the responsibility falls entirely on the developers as they are responsible for distributing their product to their clients and/or customers. AI is solely the mouthpiece of the goals and ambitions of the developers.

While there is unintended behavior that they may not have anticipated, it doesn't absolve anyone who developed it from being held accountable. AI is a helpful tool, but it's also a serious one that can go sideways for businesses and individuals who use it.

There are 5 notable instances in which AI or its agentic variant have caused serious consequences as a result of unintended behavior, negligence, or malicious intent stemming from the developers' own decisions:

Air Canada's False Chatbot Response: In November 2022, Jake Moffatt asked a question to Air Canada's chatbot regarding their bereavement refund policy after his grandmother passed away. This led to a claim being denied, resulting in a tribunal case that eventually led to Air Canada being held liable in February 2024, approximately 15 months after the incident. The latter subsequently claimed the AI agent was, in their words, "a separate legal entity" responsible for its own actions..
Waymo Mishaps in Texas: Instances include the deadly March 2026 West Sixth Street shooting in Austin, Texas where a responding Austin PD officer was forced to move a Waymo vehicle after it got stuck to make way for an ambulance responding to the scene, an apartment explosion that occurred in Dallas, Texas in early June 2026 where first responders' path was blocked, and similar incidents occurring from March to May 2026 across North, Central and Southeast Texas, resulting in Waymo suspending their services in the affected cities.
March 2026 Amazon Outages: Amazon experienced multiple outages following a change to its retail platform within the span of a week. This resulted in multiple operations going down worldwide, ranging from checkout to delivery services. While Amazon officials originally cited generative AI as a contributing factor, it subsequently reversed its position, putting the blame on one of their software engineers following "inaccurate advice" from outdated documentation that an AI agent referred to them.
False advertising utilizing well-known South Florida lawyer's image: In June 2026, AI has been used to create false advertisements using South Florida lawyer Ángel Leal's image with the goal of promising deportees a chance of returning to the United States if they paid $1,500 to use his legal services. While not necessarily the result of a developer's actions, the lack of guardrails allowed the scammers to promote their campaign, resulting in multiple federal investigations and Leal's reputation being tarnished through no fault of his own.
Character.AI and Meta AI Studio August 2025 investigations: The Texas Attorney General's office released a statement in August 2025, announcing investigations into Character.AI and Meta AI Studio regarding their chatbot platforms and data privacy/collection practices. The Attorney General's office alleges that both companies have potentially engaged in false advertising and deceptive trade practices by distributing its AI agents to its users without the proper guardrails in place. They allege that as a result, it has led to vulnerable individuals and minors alike to use it for emotional support, despite the products lacking a medical license to practice it.

Based on these five instances, they all point to a similar pattern: a lack of accountability mixed with a lack of guardrails and safety measures in place, resulting from a lack of oversight and responsibility on the developers' part to ensure that these systems were set up in the first place before deploying it to production.

This is the standard that I hold myself to when developing products such as Benny. While no development process is perfect, we can reduce the risk of human error by ensuring that we do our due diligence on what we want our AI agents or any other software product to do.

We have to also realize that as soon as an error is found, we are ultimately responsible for the impact it has on our customers, clients, and end users utilizing the product.

I heavily emphasize this as a software developer because as someone who has worked with customers and clients in the past, every action we take will lead to a chain reaction of small events that lead to severe consequences if they are not addressed properly. If you are still doubting the severity, you can refer to the incidents that have plagued Amazon's retail services for a week or any other horror story involving a form of AI or its agentic variant.

Currently, I am setting up Benny to detect false leads through the use of different actions, such as detecting user inactivity, context, and past references using a combination of retrieval augmented generation and software engineering principles/ethics with human-in-the-loop approaches (i.e. manual reviews, additional references, escalation, etc.).

Even with all the guardrails in place, Benny will eventually flag an actual lead as a false positive, and vice versa. It often results from malicious actors evolving their tactics. Regardless, those same forementioned measures that are in place will learn from it, reducing the frequency of such events.

Ultimately, the AI is only the mouthpiece for its developer, the individual(s) and/or the company; a PR spokesperson who is there to speak on their behalf.

So, who's truly responsible for the actions of an agentic AI? The AI? Or the developers that wrote it? The answer is simple: it will always come down to the developer, because they have the nuances and mental capability that will determine their behavior that an AI can't develop on their own at this point.

Now ask yourself this question: have you ever let an agentic AI or any form of AI make decisions for you? And if something went wrong, who answered for the impact it caused? You, the person reading this? Or the very system you helped create?

Correction on June 20, 2026 at 5:17 PM: I misquoted the article citing Amazon Web Services as the platform that experienced the outages. The original article states that Amazon released a statement saying that AWS was not affected, and only its retail services and app were affected. The article has been updated to reflect this.

Agentic AI: Are we giving it too much of our agency?

Ruben Arevalo — Fri, 12 Jun 2026 00:20:29 +0000

Ever since launching my first boutique consulting agency/studio, Ruben Arevalo AI & Software Studio at the age of 24, the first question that came to the top of my head was:

Are we giving AI too much of our agency?

Agentic AI is a concept that's been in the making for decades. We now apply it to every aspect of our lives; answering phone calls, streamlining workflows, and improving HR operations that would normally take hours of work.

However, I've noticed that ever since the launch of OpenAI's ChatGPT in November 2022, people have started to trust AI to make decisions for them. These decisions range from what they're having for dinner, date night ideas, and for people working in the tech industry, shipping production software to accomplish ambitious goals and projects within tight deadlines.

AI has evolved over the past few decades, and has been successful in many use cases, such as diagnosing cancers that normal MRI scans wouldn't have caught and answering difficult questions to problems that would have taken years to solve. It has also extended to retrieval augmented generation (RAG), relying on an external knowledge base that it has never been trained on, thus erasing the knowledge cutoff barrier.

AI, however, has its dark side. Multiple cases of its misuse can be attributed to several instances, such as:

Non-consensual images of people and celebrities being made, depicting them in compromising positions, with the most infamous instance being Taylor Swift back in January 2024 according to an article published by the Associated Press.
Voice cloning scams that have caused both legal and emotional damage, with an instance dating back to July 2025 where a Florida mother handed over $15,000 after receiving a call from an entity cloning her daughter's voice.
A 180% increase in fraud crimes and attempts ranging from falsifying official documents to bypassing stringent automated and manual check systems that would normally catch unauthorized attempts at accessing extremely sensitive customer and financial information held by financial and fintech organizations.

Despite the horror stories that I encountered over the years as AI continued to evolve, I decided to start on a project for my AI studio, which will not only help customers with their questions and automatically submit leads for them, but also implement the same safeguards that will reduce the attempts at fraud while also encouraging users to make their own choices when describing a project and providing their requirements.

I am currently working on a new version of my chatbot called Benny, named after a nickname a coworker had given me to avoid confusion between the multiple Rubens that he has encountered in his life. For the tech stack, I am planning to use the following:

Python
FastAPI
OpenAI API (or Anthropic's SDK library) to handle the automation and submission process of requests coming from my site's chatbot

Benny will be built with the purpose of automating and submitting information to my leads in a structured format so I can fully understand what my client is looking for. The AI agent will be handling the submission of requests, while those same requests are manually and carefully reviewed by me to ensure that they are fully compliant with regulations and state law. This helps create the separation of concerns that aligns with not just software engineering but also creates the line of what can be automated vs manually reviewed by a human/live agent.

Beyond lead qualification, Benny will also serve as an internal HR monitoring tool within J.A.L.E, my studio's business operations + CMS platform. More details about Benny will be published on rubenarevalo.com in the middle of the month.

This brings me to the point I want to share for anyone who is reading this article. When we build something that is meant to improve our lives, we often forget that we are delegating not just our tasks, but also a piece of our autonomy, to an entity that does not have the same nuances and decision-making processes of a human being. There is always a price that we have to pay when building something truly amazing that can be both very beneficial but also maliciously exploited.

For example, if you're a hiring manager, and you're looking to hire a commercial truck driver using solely AI, it will definitely make things easier for you and allow you to focus on the critical aspects of the process, such as the application review, in-person screening interview, and verbal examination, though the process varies by company.

However, there is one critical part that may be missed during this process, and it is the background check. Because the employer decided to use only AI for the interview process, they forgot to check that the driver they hired has a history of driving under the influence, on top of having their license suspended twice. Again, this is only an example, but it highlights the discrepancies that AI or its agentic counterparts may cause if not balanced carefully with our own judgment, which is a crucial part of our agency as human beings.

A second notable example would be the use of AI by students. While AI has helped students grasp concepts better, it has also impacted our critical thinking abilities as revealed in findings of a study released by MIT back in November 2025. AI has helped us accomplish very ambitious projects and goals ever since OpenAI's ChatGPT was introduced in November 2022, but it has also cost us pieces of our own autonomy. By depending more on AI, the neural pathways in our brain that map to and are critical to our creativity, critical thinking, and decision-making skills are slowly reduced depending on how dependent we become on it. This same dependency especially impacts children, teenagers, and young adults under the age of 25, the age at which our brains reach full development.

Lastly, I am currently working on a separate project as part of my studio's goals. The name of the project is J.A.L.E, which stands for Job Automation & Logistics Engine. J.A.L.E. is based on the Spanish word for "jale", a slang word that is used in Latin America to refer to a job, work, or occupation. J.A.L.E. takes CMS and operational management concepts and merges them into one system, ensuring that anyone who utilizes my product in the future not only connects it to their website, but is also used for tracking project management, which will be reflected in a statement of work (SOW), capturing the entire scope of the project and what was done while also noting down the individual parties who were responsible for carrying out certain aspects of a project.

But the most significant role agentic AI plays in J.A.L.E isn't in the statement of work, but with payroll, a very common issue small business owners face. In addition to Benny's capabilities of answering and submitting inquiries from potential leads in my website, it will also have instructions to review discrepancies in employees' timesheets, such as detecting whether employees have worked a certain amount of hours (e.g. 40 hours in 3 days) during the week, if they have not clocked out, if their pay does not match the hours they actually worked, and more. These discrepancies will be flagged for manual review by a human who is specialized in HR management and operations to ensure fairness and consistency across the board.

By implementing this approach, it further supports and adds to the notion that a separation of concerns is necessary when dealing with an entity that is nuanced but is prone to making errors, and another entity who is less likely to make them but does not have the nuances and understanding of human nature.

As someone who is building their own AI studio and agentic AI, I believe that somewhere along the way, there were moments where we gave away a piece of our autonomy to AI when we look for product recommendations, recipe ideas, and more. Even though we only gave a tiny piece of our autonomy and trust away to an entity that lacks human nuance, that's all it takes. And unfortunately, if we continue this pattern without balancing our own judgment and needs, we will eventually forget what made us who we are in the first place. It will reduce the hard work we have put in ourselves along the way into a mere shadow of ourselves.

Now the important question we must ask ourselves, where do we draw the line between what we decide and what AI can decide for us, both professionally and personally?