Let's say you follow a link to a github project and you have to assess whether to trust that code, how do you do it?
Before AI just having a good README and superficially looking good code (we're not going to do a deep review of it) was a gauge of quality that at the very least the person that wrote it knows what it's doing.
How do you do it now? Maybe the AI was expertly guided, but maybe it was vibe-coded by someone who hasn't even heard of basic security principles and your whole data is sent in plain-text somewhere. It doesn't have to be nefarious, it could be a debug feature that was never removed, or maybe the user never asked the llm to "make it prod safe". And there's no way to know unless you read the whole thing, because superficially the README and the code will look as good as any other llm project.
That's problem number one, before you could quickly see if it's made by someone who knows what it's doing, and thus that you can trust. With vibe-coded software not so much.
The second issue is not inherent to vibe-coded software but it's caused by it: it's a sea of garbage. It's very possible that the absolute amount of good software has increased, but it's become harder to find it.
I disagree with your premise that anyone seemingly competent can be trusted.
> It's very possible that the absolute amount of good software has increased, but it's become harder to find it.
It was like that long before AI. Most software written by humans is very bad, and it was accelerating before AI. And there was too much software to review everything long before AI as well.
If anything, I find that AI writes better code than the average human-written code. Of course it makes it harder to judge the contributor (before I could clearly see that they were not good coders, now I can't). But as a maintainer, I was reviewing the code before, and I am still reviewing it now. Some people will send unreadable AI-generated PRs that I won't review, some people will send readable PRs that I will review and merge without any consideration of provenance.
A problem could be that I may receive too many PRs to review (I think it happens to Linux). And the consequence of that may be that opening a PR to big open source projects may have to become less accessible eventually.
Before AI just having a good README and superficially looking good code (we're not going to do a deep review of it) was a gauge of quality that at the very least the person that wrote it knows what it's doing.
How do you do it now? Maybe the AI was expertly guided, but maybe it was vibe-coded by someone who hasn't even heard of basic security principles and your whole data is sent in plain-text somewhere. It doesn't have to be nefarious, it could be a debug feature that was never removed, or maybe the user never asked the llm to "make it prod safe". And there's no way to know unless you read the whole thing, because superficially the README and the code will look as good as any other llm project.
That's problem number one, before you could quickly see if it's made by someone who knows what it's doing, and thus that you can trust. With vibe-coded software not so much.
The second issue is not inherent to vibe-coded software but it's caused by it: it's a sea of garbage. It's very possible that the absolute amount of good software has increased, but it's become harder to find it.