Vibe Coding Is Everywhere, But Experts Warn It's Leaving Security Holes In Apps

It would be hard to forget July last year, when the internet couldn’t stop talking about the Tea Dating Advice app. Launched in 2023 as a women-only platform, Tea positioned itself as a safety-first space where women could flag men who were married or had past criminal records.

That July, the app suffered a massive data leak. Private messages and personal images of users, including selfies and addresses used for verification purposes from the app, surfaced on 4chan, the anonymous image board. Days after the first leak, another 1.1 million messages were posted online, many containing private conversations around deeply sensitive topics. The app that promised a safe space for women had now become the place where their data is stolen and exposed.

The data breach came at a particularly interesting time, when “vibe coding” had only just started to become popular in the tech space. Following the breach, allegations emerged that Tea may have been a vibe-coded app—claims that, accurate or not, pushed broader concerns about the security of AI-assisted development into focus.

What Vibe Coding Is, and Why It Matters for Security

Vibe coding was a concept coined by AI researcher Andrej Karpathy in early 2025. He described it as a workflow where developers stop writing code line by line and instead guide AI models to generate, refine, and debug applications through conversation. This essential means that AI authors the code that apps and websites run on.

To date, it has not been confirmed where the Tea app was vibecoded. But the incident sparked a larger debate about the security risks that could emerge when AI-generated code is shipped quickly, often without deep technical oversight?