Y Combinator Startups and Vibe Coding: What 91% AI-Generated Codebases Really Mean

Back in February 2025, something unexpected happened in the startup world. A group of Y Combinator founders built entire applications without writing a single line of traditional code. They didn’t use frameworks. They didn’t debug with breakpoints. They just talked to AI-described what they wanted, got code back, and called it done. This wasn’t a one-off experiment. By March 2025, 91% of the code in Y Combinator’s Winter 2025 batch was generated by AI. Not 30%. Not 60%. Over nine out of ten lines of code came from large language models. And they called it vibe coding.

What Is Vibe Coding, Really?

Vibe coding isn’t just using AI to help write code. It’s letting AI write the code-and not looking too closely at how it works. Andrej Karpathy, the name behind the term, described it as "fully giving in to the vibes, embracing exponentials, and forgetting that the code even exists." You tell the AI: "Build me a restaurant menu generator that lets users reorder dishes." The AI spits out a full React + Node.js app. You test it. It works. You ship it. No deep dive into the database queries. No checking if the auth system is secure. You trust the vibe.

But here’s the catch: if you review every line, fix every bug, and understand every dependency-you’re not vibe coding. That’s just using an AI assistant. Vibe coding means accepting the output as-is, even if you don’t know why it works. It’s like handing over your car keys to a robot and saying, "Just get me to work. I don’t care how."

The Y Combinator Experiment

Y Combinator didn’t just observe this trend-they encouraged it. The Winter 2025 batch had founders who had never written a line of Python or JavaScript before. They used ChatGPT, Claude, and Gemini to build everything: user authentication, payment processing, real-time notifications, even database schemas. One founder built a grocery delivery app with 97% AI-generated code. Another created a scheduling tool that handled 500+ concurrent users-all from prompts like, "Make a calendar that syncs with Google and sends SMS reminders."

By the time demo day rolled around, 25% of the startups had codebases that were 95% AI-generated. That’s not a fluke. That’s a systemic shift. Garry Tan, YC’s CEO, didn’t panic. He said, "This is the new normal. The question isn’t whether AI can build apps. It’s whether we can build apps that last."

The Hidden Cost: Bugs, Security, and Scaling

Here’s where things get ugly. In December 2025, CodeRabbit analyzed 470 open-source pull requests where AI had co-authored code. The results were startling:

• AI-generated code had 1.7x more major issues than human-written code.
• Security vulnerabilities appeared 2.74x more often-like hardcoded API keys, unvalidated inputs, and broken session handling.
• Logic errors? 75% more common. Think: infinite loops, incorrect database joins, race conditions.
• Code readability? Terrible. Variable names like "data1" and "temp2," inconsistent indentation, and missing comments were the norm.

One startup built an appointment booking system using vibe coding. It worked fine for 30 users. When they hit 10,000, the whole thing crashed. Why? The AI had generated a single-threaded server that couldn’t handle concurrent requests. No one noticed because the prototype worked on their local machine.

And debugging? That’s where vibe coding falls apart. "Let’s say a startup with 95% AI-generated code goes out there," Tan said, "and a year later, they have 100 million users. Does it fall over? The first versions of reasoning models are not good at debugging. You have to go deep into what’s happening. And if you don’t understand the code, you can’t fix it."

Why AI Can’t Build Real Products (Yet)

AI doesn’t understand context. It doesn’t know what "secure" means beyond patterns it’s seen. It doesn’t care if a library hasn’t been updated in three years. It just spits out what’s statistically likely.

Take dependency management. An AI might pick a popular npm package because it’s in 90% of the training data-even if that package has known security holes. It doesn’t know the difference between a well-maintained tool and a abandoned one. It just picks what looks familiar.

And then there’s hallucination. One founder asked AI to "implement OAuth2 login with Google." The AI generated code that looked right-but never actually called Google’s API. It just returned a fake token. The app passed tests because the tests were also generated by AI. No one caught it until a real user tried to log in.

Cognitive scientist Gary Marcus put it bluntly: "The algorithm didn’t solve a problem. It copied a solution from its training data."

Who’s Actually Winning With Vibe Coding?

It works great for prototypes. For MVPs. For weekend hacks. But not for anything that needs to scale, stay secure, or evolve over time.

Some founders are adapting. They use vibe coding to build fast-but then hire a senior engineer to refactor everything. One team used AI to build their entire backend, then spent three months rewriting it with proper error handling, logging, and monitoring. They called it "vibe-to-production."

Others are building guardrails:

• Requiring 100% test coverage before any AI-generated code is merged.
• Using TypeScript to force structure, so even if the AI messes up, the type system catches obvious errors.
• Only allowing AI to generate small, isolated components-not entire systems.
• Adding automated security scans (like Snyk or Checkmarx) to every CI/CD pipeline.

But here’s the truth: if you don’t understand the code, you can’t improve it. And if you can’t improve it, you’re stuck. You’re not building a product. You’re building a time bomb.

The Bigger Problem: Homogenization

There’s another quiet crisis. AI models are trained on the most popular codebases on GitHub. That means they favor the same libraries, patterns, and architectures over and over. Everyone ends up with the same code. Same React components. Same Express.js structure. Same Firebase setup.

That’s not innovation. That’s replication. New open-source tools? They get buried. Unique solutions? They’re statistically unlikely. The AI doesn’t pick the best tool. It picks the most common one. And that’s making software boring. And brittle.

Maya Posch from Hackaday put it this way: "We’re losing the diversity of thought that made software interesting."

Can Vibe Coding Survive?

Y Combinator didn’t shut it down. They didn’t ban it. They watched. And they’re betting that the next wave of AI will fix these issues. Maybe models will get better at reasoning. Maybe they’ll learn to audit their own code. Maybe fine-tuning on "before and after" fixes will make them smarter.

But right now? The data says no. Vibe coding is a shortcut that breaks under pressure. It’s like using a drone to build a house. You can lay bricks fast. But if the foundation’s cracked, the whole thing collapses.

Founders who succeed with vibe coding aren’t the ones who gave up control. They’re the ones who used AI as a hammer-not a blueprint. They kept their eyes open. They tested relentlessly. They knew when to say, "This doesn’t make sense," and rewrote it themselves.

The future of software isn’t AI writing code. It’s AI helping humans write better code. And humans still have to be in the loop. Because no AI can feel the vibe of a product that needs to last.