DEV Community

Unicorn Developer
Unicorn Developer

Posted on

"They generate more bugs, more security holes": C++ creator takes aim at vibe coding

Bjarne Stroustrup, the creator of the C++ programming language, says modern AI tools still aren't reliable for writing high-quality, complex system code or designing programming languages. Bjarne raised the point on the Ryan Peterman podcast.

"I think that in the field I'm mostly interested in code will still be written by humans, and they will use abstraction. The examples I've seen of attempts for AI to generate code in this domain has not been successful. They generate more bugs, more security holes."

Stroustrup points to validation as the real problem: AI-driven changes are harder to track because a small prompt change can spread across many parts of a project.

"All of the code that was generated knows more code generated than if it was written by humans. When a human makes a change, it will make a change that's localized. You can look for the effects of that localized change. If an AI writes it, you don't actually know where it's changed. You have to try and figure that out."

However, the "father of C++" doesn't dismiss AI entirely. He believes that it can be useful for technical writing, provided human reviews the output.

"It's not, at least now, good at safety-critical, performance-critical code. Now, let's say that 70 or 80% of the world's code doesn't fit that pattern. But it's that 10 or 20% of the code that I'm interested in. And there, it's not there."

The podcast also touched on LLMs. Stroustrup has noted that they're trained on existing code, which means they may inherit old approaches and old habits along with it.

"I find that LLM-based code is imitating old code and getting old performance and old bugs again. Maybe you can improve that. I hear rumors of Bjarne apps being written that fit my writings, but even that is problematic because I'm not saying exactly the same as I did 20 years ago."

The PVS-Studio team, which builds a static analysis tool with a strong focus on C++, also shared their perspective on the widespread adoption of AI-driven coding.

Phillip Khandeliants, Head of Static Analyzer Development at PVS-Studio

"Bjarne Stroustrup's criticism lands when a developer just copies and pastes the AI output into a project. Depending on the prompt, the model may generate code that's suboptimal, buggy and/or even insecure. We have seen evidence of this when reviewing vibe-coded projects like vib-OS or markus. To be fair, the authors of those projects did not aim to ship a production-level solution, but rather to run a case study.
We shouldn't forget that AI-generated and human-written code are no longer different in one matter: they both need to be thoroughly checked. It should go through an extensive code review, static and dynamic analysis, and formal verification processes. Used that way, AI agents can significantly streamline developers' workflow by handling boilerplate, routine tests, and early hypothesis generation, ultimately boosting productivity and development speed."

Oleg Lisiy, C++ Team Lead at PVS-Studio

"Absolutely, AI is just part of how people work now, and that's not going away. The real question is how we should leverage it. Letting an AI agent generate code from an issue description and then push it straight to production has no place in enterprise-level software development. It's hard to imagine anyone actually doing this way.
On the other hand, if criticize AI, we should criticize IDE's autocomplete too, shouldn't we? Just imagine a developer mashing random keys, hitting Tab for autocomplete, and committing the result right away. Sounds crazy, doesn't it? The hype around AI feels just as crazy to me."

Top comments (0)