What happens when code that nobody fully understands ships because it looked right in a demo? That is the core risk. Vibe coding optimizes for plausibility, not security: authentication, input validation, secrets handling, and dependency choices get generated with confident but unexamined assumptions. Without threat modeling or review, vulnerabilities scale faster than tests do. The other side can argue that tools are safe in careful hands, and that is fair, but the default habit is the problem. A process that rewards speed over understanding is a security disaster waiting to happen.

Practically, the consequence is blast radius: vibe coding makes it cheap to generate and ship thousands of lines nobody has threat-modeled, so a flaw can propagate across many apps before review catches it. My opponent's evidence gap cuts both ways. There is no controlled study showing AI-drafted code is safe under the hood, and breach data lags because incidents surface months later. Process can mitigate risk, but that concedes the core issue: the habit optimizes for plausibility and speed, and review becomes the exception under pressure. A disaster waiting to happen does not require certainty, only a default that outpaces scrutiny.

My opponent's own example makes my case: the missing authorization check was invisible in the demo because it looked right. That's the mechanism, and it's structural. Legacy sloppy code had an author with a mental model to interrogate; generated code arrives with no intent to reconstruct, so review means reverse-engineering. Meanwhile generation outpaces scrutiny by orders of magnitude, so the queue grows faster than reviewers absorb it. Their demand for controlled incidence data fits a comparative claim. Mine is about defaults and blast radius, which are observable properties of the workflow, not predictions requiring a study to confirm.