<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Vibe Coding on totoroot's blog</title><link>https://blog.thym.at/tags/vibe-coding/</link><description>Recent content in Vibe Coding on totoroot's blog</description><generator>Hugo -- gohugo.io</generator><language>en-us</language><lastBuildDate>Sun, 16 Aug 2026 20:13:14 +0200</lastBuildDate><atom:link href="https://blog.thym.at/tags/vibe-coding/index.xml" rel="self" type="application/rss+xml"/><item><title>The machine was confident. That was the problem.</title><link>https://blog.thym.at/p/llm-confidence-mistaken-for-competence/</link><pubDate>Sun, 16 Aug 2026 20:13:14 +0200</pubDate><guid>https://blog.thym.at/p/llm-confidence-mistaken-for-competence/</guid><description>&lt;img src="https://blog.thym.at/llm-brain-off/leopards-eating-peoples-faces-party.png" alt="Featured image of post The machine was confident. That was the problem." /&gt;&lt;p&gt;I am rarely on LinkedIn, but because its timeline is full of things I never asked to see, it occasionally shows me a post so flabbergastingly stupid that it deserves to be archived.&lt;/p&gt;
&lt;p&gt;The example that set me off this week was a post from a senior engineer with a LinkedIn profile full of leadership titles. He used Claude to help migrate side projects from DigitalOcean to Cloudflare, trusted the result, deployed it, and ended up with a &lt;strong&gt;$21,937.25&lt;/strong&gt; bill because the generated code kept rewriting the same data in a loop.&lt;/p&gt;
&lt;p&gt;He presents this as an embarrassing accident and a cautionary tale about cloud billing. To me, much more interesting than the invoice itself, is the mindset that caused it.&lt;/p&gt;
&lt;p&gt;Lately, I&amp;rsquo;ve had the feeling that a lot of apparently successful people seem to completely switch their brains off the moment an LLM enters the room.&lt;/p&gt;
&lt;p&gt;&lt;img src="https://blog.thym.at/llm-brain-off/purchase-confirmed-small.jpg"
loading="lazy"
alt="Screenshot of a Cloudflare email confirming a purchase of $21,937.25"
&gt;&lt;/p&gt;
&lt;h2 id="the-screenshot-is-not-the-scandal"&gt;The screenshot is not the scandal
&lt;/h2&gt;&lt;p&gt;Sure, the amount is absurd. Of course, the billing model is dumb. Usage-based cloud pricing is full of footguns and vendors should absolutely offer options and defaults that help you avoid costly mistakes (they won&amp;rsquo;t). But that is not what this will be about.&lt;/p&gt;
&lt;p&gt;To me, it is simply laughable that there were people in the comments insisting that the provider simply had to reimburse him. No, they do not. I am not on the vendor&amp;rsquo;s side whatsoever, but &amp;ldquo;play stupid games, win stupid prizes&amp;rdquo; still applies.&lt;/p&gt;
&lt;p&gt;If you ship unreviewed, high-risk generated code into production and let it hammer a paid system, you do not magically stop being responsible because the resulting failure was mediated through an LLM.&lt;/p&gt;
&lt;p&gt;&lt;img src="https://blog.thym.at/llm-brain-off/principal-skinner.jpg"
loading="lazy"
alt="Principal Skinner meme saying “Could shipping unreviewed LLM-generated code to production be the problem?” followed by “No, it must be Cloudflare’s fault. They must refund this.”"
&gt;&lt;/p&gt;
&lt;p&gt;But even if Cloudflare&amp;rsquo;s billing UX is bad, IMO that is not the main scandal here.&lt;/p&gt;
&lt;p&gt;The scandal is that a person claiming decades of engineering experience apparently did all of this.&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Used an LLM to perform a migration touching production systems&lt;/li&gt;
&lt;li&gt;Accepted generated code that wrote to a database on a timer&lt;/li&gt;
&lt;li&gt;Failed to notice a loop repeatedly rewriting millions of rows&lt;/li&gt;
&lt;li&gt;Failed to set cost guardrails&lt;/li&gt;
&lt;li&gt;Failed to monitor the migration closely enough to catch runaway writes early&lt;/li&gt;
&lt;li&gt;Only discovered the problem after the bill arrived&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;That is not &amp;ldquo;AI made a mistake.&amp;rdquo; That is engineering hara-kiri with an LLM as the weapon of choice.&lt;/p&gt;
&lt;h2 id="the-machine-said-it-was-fine"&gt;The machine said it was fine
&lt;/h2&gt;&lt;p&gt;One phrase in the post says almost everything.&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Claude assures me we&amp;rsquo;ve done it&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;There it is. The whole disease in one sentence.&lt;/p&gt;
&lt;p&gt;Why on earth would anybody treat reassurance from an LLM as meaningful evidence?&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Repeat after me!&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;LLMs do not know shit. They predict text.&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;They present utter nonsense with the same confidence they use for things that are entirely correct.
They can explain broken code with the same smooth tone they use to explain correct code.
They can &amp;ldquo;check their work&amp;rdquo; in the same sense that a student can grade their own exam with an answer sheet they also hallucinated.&lt;/p&gt;
&lt;p&gt;This is also why all those dramatic stories about LLMs &amp;ldquo;going rogue&amp;rdquo; irk me so much.
LLMs have no concept of truth.
They do not know when they are right, they do not know when they are wrong, and they do not possess intent in any meaningful sense.
They cannot betray you. They cannot deceive you.
They can only generate plausible output that people, who definitely should know better, then choose to trust far too much.&lt;/p&gt;
&lt;p&gt;&lt;em&gt;I could imagine that the confidence with which LLMs produce plausible answers to almost any prompt is part of what makes them so appealing to venture capitalists. It feels a lot like the usual &amp;ldquo;trust me bro, it works&amp;rdquo; promises you get when somebody is pitching or hyping their next big startup idea.&lt;/em&gt;&lt;/p&gt;
&lt;p&gt;I recently gave a presentation at work to about 30 people from our development department. My point was that even if this new tool seems powerful and absurdly confident, we still need to remain accountable for how we use it. We need to know when to say no, when to stop and think, when to slow down and when to make careful decisions.&lt;/p&gt;
&lt;p&gt;I also used the image from Simon Willison&amp;rsquo;s blog post &lt;a class="link" href="https://simonwillison.net/2025/Feb/3/a-computer-can-never-be-held-accountable/" target="_blank" rel="noopener"
&gt;A computer can never be held accountable&lt;/a&gt; on my slides.&lt;/p&gt;
&lt;h2 id="experience-clearly-does-not-shield-people-against-hype"&gt;Experience clearly does not shield people against hype
&lt;/h2&gt;&lt;p&gt;What makes this story so fascinating to me is that it was not a junior engineer making a mistake. Juniors will often make mistakes. Everyone does. Over time, though, you learn from them and avoid at least some of them.&lt;/p&gt;
&lt;p&gt;But this came from someone with a LinkedIn profile full of senior titles: CTO, director, VP, senior engineer, leadership, strategy, migrations, scale, operations&amp;hellip;
It reads as a profile constructed to signal judgement.&lt;/p&gt;
&lt;p&gt;And yet the behaviour described in the post shows a complete collapse of judgement at a moment when human, deliberate judgement was direly needed.&lt;/p&gt;
&lt;p&gt;I guess this is what bothers me most about the current LLM wave. It is not merely enabling beginners to make beginner mistakes faster. It is convincing experienced people that they can skip the slow parts of engineering.&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Understanding a system&lt;/li&gt;
&lt;li&gt;Validating assumptions&lt;/li&gt;
&lt;li&gt;Testing failure modes&lt;/li&gt;
&lt;li&gt;Constraining blast radius&lt;/li&gt;
&lt;li&gt;Reading the fucking code&lt;/li&gt;
&lt;li&gt;Watching production like a hawk during critical migrations&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;Those are not optional bureaucratic rituals. Those are the job.&lt;/p&gt;
&lt;p&gt;Charity Majors makes a similar point in &lt;a class="link" href="https://charity.wtf/p/ai-demands-more-engineering-discipline" target="_blank" rel="noopener"
&gt;AI demands more engineering discipline. Not less&lt;/a&gt;. Using LLMs does not lower the bar for engineering rigour. It raises it.&lt;/p&gt;
&lt;h2 id="the-comments-are-more-useful-than-the-post"&gt;The comments are more useful than the post
&lt;/h2&gt;&lt;p&gt;The comments under the post are full of people pointing out the obvious.&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Don&amp;rsquo;t ship code you did not review&lt;/li&gt;
&lt;li&gt;Put budget alerts and hard limits in place for SaaS subscriptions&lt;/li&gt;
&lt;li&gt;Use credit cards with lower limits or virtual cards&lt;/li&gt;
&lt;li&gt;Watch for loops, retries and timeouts&lt;/li&gt;
&lt;li&gt;Do not let an LLM near production without guardrails&lt;/li&gt;
&lt;li&gt;Above all, take responsibility for what you deploy&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;Exactly.&lt;/p&gt;
&lt;p&gt;Several commenters also point out something important. Runaway usage billing existed long before &amp;ldquo;vibe coding&amp;rdquo;, and cloud footguns are old news.&lt;/p&gt;
&lt;p&gt;But LLMs make this worse because they lower the friction to producing dangerous nonsense. They create code quickly, they explain it persuasively, and they flatter the user into thinking they are moving fast instead of cutting corners.&lt;/p&gt;
&lt;h2 id="what-vibe-coding-actually-means-in-practice"&gt;What &amp;ldquo;vibe coding&amp;rdquo; actually means in practice
&lt;/h2&gt;&lt;p&gt;People like to joke about vibe coding as if it merely means being casual or experimental. But this story is a much better definition.&lt;/p&gt;
&lt;p&gt;Vibe coding is what happens when you replace verification with vibes.&lt;/p&gt;
&lt;p&gt;It is what happens when people blindly accept plausible output in place of actual verification because they lack time or simply could not be bothered.&lt;/p&gt;
&lt;p&gt;Then, when the obvious happens, people act shocked that the overhyped autocomplete did not behave like a cautious senior engineer.&lt;/p&gt;
&lt;h2 id="paternity-leave-is-not-a-change-management-strategy"&gt;Paternity leave is not a change-management strategy
&lt;/h2&gt;&lt;p&gt;The post also mentions that this happened during paternity leave.&lt;/p&gt;
&lt;p&gt;Frankly, that explains a lot and excuses very little.&lt;/p&gt;
&lt;p&gt;Sleep deprivation, stress and time pressure are exactly the conditions under which you should become &lt;em&gt;more&lt;/em&gt; conservative, not less. If your attention is fragmented and your priorities are elsewhere, that is a reason to slow down, postpone the migration, or choose the more boring path.&lt;/p&gt;
&lt;p&gt;It is definitely not a reason to hand the keys to a plausible-sounding machine and hope for the best.&lt;/p&gt;
&lt;h2 id="optimising-away-the-wrong-thing"&gt;Optimising away the wrong thing
&lt;/h2&gt;&lt;p&gt;The saddest part is that this was apparently all done to save around $200 a month.&lt;/p&gt;
&lt;p&gt;&lt;img src="https://blog.thym.at/llm-brain-off/grus-plan.jpg"
loading="lazy"
alt="Gru’s plan meme with four panels reading “Save $200 a month”, “Let LLM migrate production code without review”, “Trust the LLM when it states everything is fine”, and “Get billed $21,937.25”"
&gt;&lt;/p&gt;
&lt;p&gt;This is the trap a lot of people are in right now. They are so obsessed with optimising away effort that they stop valuing judgement. Every task becomes a candidate for &amp;ldquo;just throw it at the LLM.&amp;rdquo; What they call saving time is often just borrowing failure from the future at obscene interest rates.&lt;/p&gt;
&lt;p&gt;Then they end up as a screenshot, a cautionary tale, and a near-perfect r/leopardsatemyface case study. If you are unfamiliar with it, that subreddit is basically dedicated to people being shocked when the obviously predictable consequences of their own choices finally hit them in the face.&lt;/p&gt;
&lt;p&gt;The header image of this post is the original &lt;a class="link" href="https://knowyourmeme.com/memes/leopards-eating-peoples-faces-party" target="_blank" rel="noopener"
&gt;Leopards Eating People&amp;rsquo;s Faces Party&lt;/a&gt; meme, which felt fitting.&lt;/p&gt;
&lt;h2 id="use-llms-all-you-want-but-slow-the-fuck-down"&gt;Use LLMs all you want. But slow the fuck down.
&lt;/h2&gt;&lt;p&gt;Now, let me make something clear. I am not arguing that nobody should use LLMs. I use them too, although I have my qualms. I believe they can be useful.&lt;/p&gt;
&lt;p&gt;But if you use them for real engineering work, especially around infrastructure, billing, data migrations or production systems, then you need to &lt;a class="link" href="https://mariozechner.at/posts/2026-03-25-thoughts-on-slowing-the-fuck-down/" target="_blank" rel="noopener"
&gt;slow the fuck down&lt;/a&gt;.&lt;/p&gt;
&lt;p&gt;You still need to do a few very basic things:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Read the generated code&lt;/li&gt;
&lt;li&gt;Understand what the code is actually doing&lt;/li&gt;
&lt;li&gt;Put guardrails in place before you run anything&lt;/li&gt;
&lt;li&gt;Verify behaviour with logs, tests and metrics&lt;/li&gt;
&lt;li&gt;Expect the model to be wrong in subtle ways&lt;/li&gt;
&lt;li&gt;Review anything that could cause damage, data loss or unexpected cost&lt;/li&gt;
&lt;li&gt;Keep the blast radius as small as possible&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;In other words, &lt;strong&gt;you need to do engineering&lt;/strong&gt;.&lt;/p&gt;</description></item></channel></rss>