How Intuition-Driven AI Coding Is Quietly Raising DeFi's Risk Profile

A growing share of software today is written not through careful design but through a kind of improvisation: a developer opens an editor, lets an AI assistant such as Copilot generate the bulk of the logic, and ships whatever compiles — often without reading documentation, sketching a threat model, or writing tests. Commentators have started calling this workflow "vibe coding," and it has moved well past hobbyist projects into the core of how much commercial software gets built.

The appeal is speed. Suggestions arrive instantly, feel plausible, and frequently run on the first attempt, so teams treat "it compiles and it runs" as sufficient grounds to deploy. The trouble is that fluent-looking code and correct code are not the same thing, and the practice increasingly substitutes a felt sense of confidence for verification.

Move37 has described this pattern directly: engineers writing by feel, pasting snippets they don't fully understand, and iterating until the result appears to work — without ever establishing why. This is no longer a fringe habit. According to GitHub CEO Thomas Dohmke, as reported by CNBC, roughly 40 percent of code written by developers using Copilot is now AI-generated. More recent figures from Tenet put the average at 46 percent, rising as high as 61 percent among Java developers. Tools like Cursor have become the standard working environment for whole engineering teams, and it's now common for ChatGPT to be used to troubleshoot live production issues.

What was marketed as a way to make everyone a capable developer has, in practice, made it possible to ship systems whose builders don't fully understand them — because the tooling optimizes for output that looks correct rather than output that is correct. MIT Sloan Management Review has noted that while AI raises the speed of development, it raises the speed at which errors propagate right alongside it. Andela's research frames this as a shift toward an "intuition stack" — a mode of working built on pattern recognition and a feel for when AI output is wrong, rather than on rigorous verification. The same research found that only 29 percent of developers feel confident they could spot a vulnerability in AI-written code, and cites a Forrester projection that more than half of technology organizations would carry significant technical debt tied to this by 2025.

Nowhere is the downside starker than in crypto. DeFi protocols deploy smart contracts holding large sums with no rollback mechanism: a flaw isn't merely a defect to patch later, it's a standing invitation to drain the contract, and once funds move, there's no undo.

Why developers trust the machine

Psychologist Daniel Kahneman's distinction between fast, intuitive judgment and slow, deliberate reasoning — his "System 1" and "System 2" — helps explain the appeal of vibe coding. It operates almost entirely in System 1: pattern-matching, gut checks, and autocomplete suggestions that feel right because they read smoothly. The slower, more effortful System 2 process — questioning assumptions, working through edge cases, checking invariants — tends to get skipped, and a development culture that rewards shipping speed reinforces the skip.

Three related biases compound the problem. A "fluency illusion" leads developers to equate clean-looking, well-formatted AI output with sound logic, on the theory that a lack of compiler complaints implies a lack of real problems. Confirmation bias follows once code clears the happy path: an initial passing test or a smooth deployment gets treated as proof of correctness, discouraging further probing of edge cases. Finally, automation complacency sets in — once a suggestion looks plausible, critical evaluation switches off, because it's easier to trust the tool than to out-think it.

Incentive structures make the pattern harder to break. Organizations track velocity — lines shipped, features deployed — far more consistently than they track test coverage, and security audits are often viewed as costly steps that slow down launches, with post-release bug discovery effectively outsourced to users.

What the research shows

The data on outcomes is fairly consistent. ACM research from 2022, reaffirmed in a 2025 follow-up, found that intuitive (as opposed to deliberate) reasoning correlates with a measurably higher rate of software defects — developers who code primarily by feel produce more bugs, not occasionally but as a pattern, because intuition is tuned to what feels correct rather than what is.

A large-scale comparison posted to arXiv examined thousands of samples of human-written versus AI-generated code and found the AI-generated code carried a higher density of bugs per thousand lines, along with more vulnerabilities and greater complexity. A separate arXiv study looked at what happens across repeated rounds of AI-driven refactoring, finding that the model doesn't retain any memory of the original threat model between passes — it simply makes the code look tidier. Surface-level problems get resolved even as new attack surfaces are introduced, a net trade that leaves the code looking better while becoming less safe.

A systematic literature review published on PMC concluded that AI coding tools introduce vulnerability classes that weren't previously common in traditional development — not simply more of the familiar bug types, but new categories that are harder to catch and easier to exploit. Separately, research on AI-generated code licensing found that such tools frequently produce code with unclear provenance, raising copyright and IP-compliance risks tied to unknown training data.

Lawfare Media has written that AI assistants generate code that is plausible-looking but often insecure, and that developers who rely on vibe coding typically don't engage closely enough with the code to judge its quality — a problem that also affects human reviewers evaluating AI output, compounding the risk. Qwiet's catalog of resulting issues includes missing input validation, broken authentication, logic errors, and race conditions — familiar categories of flaw, produced faster and at greater scale than before.

From hypothetical to exploit

The mechanism by which this plays out in crypto follows a recognizable arc, illustrated by a few representative scenarios. A small DeFi team under deadline pressure forks an OpenZeppelin template, layers in AI-suggested modifications, and launches without an audit on the reasoning that they'll audit later once the protocol has traction; weeks after launch, an exploit drains the treasury, and the post-mortem traces it to an access-control flaw inside the AI-assisted logic that had compiled cleanly and passed basic tests. In a comparable NFT scenario, a mint function "optimized" by an AI assistant receives conditional approval from an auditor, whose conditions the team skips ahead of hype-driven demand; the mint function locks after 200 mints due to an integer overflow in the AI-written increment logic, killing the project on launch day. In a third case, a Layer 2 team ships a bridge contract built with heavy AI assistance and no formal threat model; a security researcher discloses a critical vulnerability roughly three months post-launch, tracing back to validation logic that looked sound but wasn't — by which point reputational damage is already done.

Across these patterns the underlying cause is stable even as the specific vulnerability type shifts. Halborn's 2025 report on the top 100 DeFi hacks found faulty input validation was the single largest category, accounting for 34.6 percent of contract exploits, with reentrancy dominant in 2023 and access-control issues prevalent in other periods. The same report found off-chain attacks accounted for 80.5 percent of stolen funds in 2024, and compromised accounts made up 56.5 percent of incidents — but the on-chain exploits that do hit smart contracts directly increasingly trace to developers who felt confident, AI tooling that suggested plausible-looking but flawed fixes, and organizational incentives that rewarded shipping over scrutiny. Traditional audits have caught some of this, but not all of it, partly because auditors face a parallel version of the same trap: when AI both writes and helps review code, responsibility for verifying the logic gets diffused until no one owns it.

Reducing the exposure

Mitigating the risk starts with breaking the reward loop that favors speed over understanding: reading primary documentation rather than summaries, and treating an inability to explain why code works as a signal that its failure modes are also unknown. Writing tests before writing the implementation — treating TDD as a forcing function for clarifying requirements rather than as overhead — helps surface the assumptions that intuition alone would skip past, particularly the ones that "obviously" hold.

The clearest operating principle is to never ship on intuition alone: gut feelings are appropriate for prototyping and product direction, not for security-critical code, and AI-generated code should be treated the same way any external dependency would be — subject to human review by default, with every suggestion checked rather than assumed correct. Security researchers writing for CSO have outlined complementary mitigations: mandatory human review of AI-touched code, security scanning built into the pipeline, training developers to recognize AI's characteristic mistakes, commit messages that disclose AI involvement, and audits that specifically target AI-generated sections.

Tooling changes alone won't fix a culture problem, though. That requires rewarding thoroughness on par with velocity, treating "I don't know yet" or "this needs more time" as acceptable professional statements rather than liabilities, and recognizing that a blockchain ledger enforces a binary standard — code works or it doesn't, with no partial credit for good intentions or tight deadlines.

There isn't yet a publicly confirmed crypto exploit whose root cause has been definitively attributed to vibe coding specifically — the scenarios above remain illustrative rather than documented incidents. But the underlying dynamic long predates AI: developers have always shipped under-tested Friday-afternoon patches and hotfixes between meetings, and those human-speed mistakes were survivable more often than not. What AI-assisted development changes is the velocity at which the same cognitive shortcuts can be reproduced — the vulnerabilities themselves aren't new, only the rate at which they can now be manufactured.