2. Trusting the AI’s dependencies
Mitchell Johnson, chief product development officer at Sonatype, reminds vibe coders that the code AI writes is only part of the equation. “Increasingly, AI is also deciding which open source components your application depends on. If those decisions aren’t informed by current intelligence, not just what the model learned months ago, you can end up building on outdated, abandoned, or risky dependencies without realizing it,” says Johnson.
Enterprises have historically struggled to standardize their software development stacks. Over time, many ended up with the technical debt of maintaining applications across different development platforms and versions, adding to the cost and creating complexities when extending applications. This risk is amplified if there are no specifications of which frameworks, components, libraries, and their versions the vibe coding tools can build solutions from.
How to avoid the mistake: Provide architecture requirements, specify a catalog of usable components, and update this documentation frequently, as open source and third-party component deployments may trigger new risks. Additionally, review every vibe-coded application’s software bill of materials and the integrated APIs.
