Skip to content

DEF CON 34 talks are here: 354 talks, summarized and searchable.

Browse DEF CON 34

The Beauty Of Vibe Coding

Andras Iklody

AI SecurityTalks11 minBeginnerOpen on YouTube ↗

Where

Talks
hack.lu 2025

Duration

11 min

Follows one developer's attempt to build a web UI entirely through LLM prompting, and where that approach broke down.

Summary

The speaker set out to test whether a complete application could be built with vibe coding, where a large language model makes every technical decision and the human only prompts for changes. The test project was the user interface of an anonymous reporting tool that submits data to MISP. The front end stores no data, so it looked like a low-risk candidate. The model chose Alpine.js, Bootstrap and plain HTML and CSS, and early progress looked promising, including a dynamic form layer generated from MISP object definitions.

Problems grew as the project moved into refactoring. During one refactor the model silently dropped Alpine.js in favour of another approach, split a single-page design into separate HTML files with duplicated menus and drifting styles, and rewrote whole files so that unrelated parts broke. Limited context made it forget earlier decisions and drop parts of the codebase. A long chat also overwhelmed the browser. The generated code did no output sanitisation, which left it open to cross-site scripting.

The speaker finished the last part by hand. By their estimate the project took two to three weeks, when writing it manually might have taken about one. The takeaway is that the approach suited small, tightly scoped tasks and up-front planning, but not large, multi-file, long-running projects. Generated code can look clean while hiding defects, and the time spent waiting on prompts can disguise the real cost.

Related talks