Vibe coding is fine. Shipping it blind isn't.

By now, writing code with AI is just how it's done. Not clever autocomplete, whole functions, whole features, a bug you describe in a sentence and get back fixed a few seconds later. I do it constantly, from throwaway helpers to serious pieces of real systems. You do it. The person who swears they don't does it too.

Here's the quiet part. Most of that code gets committed after a quick read, because it runs. That's the whole story. Not "AI writes bad code," it writes code that runs. The trouble lives in the distance between "it runs" and "I know this is right," and it's very easy to commit straight across that distance without noticing you did.

Two ways it gets in

New repos are the loud version. Someone has an idea on a Saturday, prompts their way to a working app by Sunday, and pushes it. Nobody reviews it, because there's nobody to review it. If you asked whether the thing was safe, most people shipping this way couldn't tell you, and nobody ever asked them to.

The quiet version is worse. Codebases that took years to build, with people who understood every corner of them, are getting AI-generated changes too. That generated code lands right next to the code someone actually reasoned through. It reads fine. It passes the quick look. It carries assumptions nobody checked. And it's hard to spot, because it looks exactly like the code around it.

Both piles grow every day, and the new code is going in without the eyes you'd want on it.

Vibe coding for enterprises

Here's the part people don't say out loud. This isn't a solo-hacker problem. Walk into a huge company right now and developers are being pushed to move faster with AI, generating far more code than any team could sit and review. The pull requests get bigger, the reviewers skim, the deadline wins. It's vibe coding for enterprises, same move, just with a logo on it and a lot more on the line.

The mechanics are identical to the weekend app. More code than anyone reads, written by something confident and fast, going in because it runs. Scale doesn't close the gap. It widens it.

"It runs" is not "it's safe"

A demo passing isn't a review. It means the happy path worked once.

A real reviewer, the kind you get on a good team, catches the rest. The logic that's subtly wrong on the third case. The edge case that throws. The error that gets swallowed. The two things that race each other. The change that quietly breaks a caller three files over. And the security holes AI is perfectly comfortable writing: a hardcoded key, unescaped input dropped into a query, an endpoint with no auth check. None of that stops the code from running. All of it ships if no one looks.

The models are good enough now that the output usually looks right, which is exactly what makes it risky. Wrong and obvious gets caught. Wrong and plausible sails through.

Now the reviewer hallucinates too

Here's where it gets worse. The platforms noticed the problem and bolted an AI reviewer onto the pull request. A second model reads your change and leaves comments. Sounds like the fix, until you live with it.

Those bots produce a wall of comments, and a lot of it is noise. Made-up issues, style nits dressed up as bugs, the same false positive repeated across twenty files. They're built to review any project on earth, so they're anchored to nothing in particular. They flag everything and mean little, and they aren't working from a defined set of standards, they just have opinions.

People treat that the way they treat any alarm that's wrong most of the time. They stop reading it. Real reviewers skim right past the bot's comments, because the last fifty were false and nobody has time to dig the two real ones out of the pile. So the AI that was supposed to catch the bad AI code gets muted, and the code goes in anyway.

That's the trap we're building. Hallucinated code, reviewed by a hallucinating reviewer, waved through by a human who has learned to ignore both.

Where this ends

Play it forward a few years. The unreviewed AI code isn't sitting in weekend toys anymore. It's in payment flows, in hospital systems, in the scheduling that keeps planes apart. Not because anyone set out to be reckless, but because every team shipped a little more code than it could read, every release, for years, and the weak spots piled up where nobody was looking.

Nobody publishes a headline that says "we committed insecure AI code and never checked it." What shows up instead is ordinary and bad: a breach, an outage, a data leak, a fine, a service that falls over at the worst possible time. Some companies absorb the hit. Some lose the trust that kept customers around and never win it back. A few don't come back at all.

The version of this that should worry us isn't dramatic. It's boring. It's the slow drift of software everyone depends on getting a little less trustworthy with every commit nobody reviewed, until the day one of those commits turns out to be the one that mattered.

Where the check belongs

The fix isn't to stop using AI. That ship has sailed, and it's a good ship. The fix is a review that runs before the code becomes history, at the moment you commit.

So that's where I put it. In TerminalNexus the commit step can run two AI reviewers over your actual diff before anything lands. One is a security check against the standards that matter, OWASP Top 10, CWE Top 25, and the compliance frameworks NIST, PCI DSS, HIPAA and ISO 27001, with every rule something you switch on or off, plus your own custom quality rules on top. The other reads your change the way a pull-request reviewer would, looking for logic errors, broken edge cases, weak error handling, concurrency problems, performance, and breaking changes.

That defined list is the whole point. The bot on the pull request is anchored to nothing, so it comments on everything. This runs against the standards you turned on and flags real violations against them, not a pile of maybes, so the report stays short enough that you actually read it. It works on the diff, not the whole tree, so it's quick and it points at real line numbers. It can go back and review any past commit the same way. You bring your own model, hosted or something local like Ollama, so if you want, none of your code leaves your machine.

It's the second set of eyes the weekend repo never had, and the one the enterprise pull request stopped getting.

Here's the whole flow in a minute:

Move fast, just don't ship blind

You can move fast. Vibe code the whole thing if that's how you work now. Just don't let it into the tree without something looking at it first, because "it ran" isn't the same as "I'd put my name on this." A check at the commit gate is a cheap way to sleep at night.

Thanks for reading. If you've watched AI code slip into something it shouldn't have, I'd like to hear about it in the comments.