I spent a day "Vibe Programming" with Cursor. The rule I set myself was that I wasn't allowed to write any code, only prompt my way to the end.
I did it because I hadn't given AI tooling a fair crack. I'd used it here and there, and mostly concluded that I was faster on my own and that it pushed me towards worse solutions. That's a comfortable thing to believe and it's how you become a dinosaur, so I gave it a proper day. Two projects, to be fair to it. One backend, where I am (full of hubris) strong. One web front end, where I am mediocre at best.
I was oddly excited about a day of low effort programming. Here's the good, the bad and the ugly.
The Good
Instant boilerplate solutions
Backend. Passable API boilerplate and a NuGet setup that was fine. It was hooked on dotnet 9 and had no idea dotnet 10 existed (in preview 2 as I write this), which didn't matter.
Frontend. I needed a React application I could deploy through AWS Amplify, and it picked Vite and React with TypeScript. A reasonable choice. It took a while to get the Vite toolchain right, so I set it to agent mode, told it to keep going until it worked, and went to make tea. I came back to a small essay it had written to itself and a functional website.
Simple problems and bug fixes
In both projects it would brute force its way through, trying one thing then another until something worked.
It was fast. Really fast. A decent starting point in minutes, on both.
The Bad
Overconfidence in wrong answers
"Ah yes, this is the answer" lands very differently when the answer doesn't compile. It says it with the same confidence either way, which means the confidence tells you nothing.
Maybe this take is coloured by what I already think of AI, but it seemed more interested in telling a good story than getting closer to a right answer. Try to nudge a nearly-correct solution and it would rewrite the whole file when a two-line tweak would have done.
Seemingly arbitrary use of third party packages
Less so in dotnet, but in the JavaScript ecosystem Cursor pulled in packages left, right and centre. Sometimes that's the right call. Twice it wasn't, once for code I could have written in ten lines and once to work around an error it had caused itself. I ended up with two different markdown renderers on two different pages doing the identical job. A junior would get that sent back in review.
Weak, niche or new tech
Niche tech was a wall. I couldn't get it near Hugging Face models at all, it just kept offering me hideously complex regular expressions for the problem I was describing.
Bun and htmx were a non-starter. It got hung up on npm and Vite as though nothing else existed, and when I forced the issue it invented APIs.
Same story with new tech. Anything past its training cut-off got confidently wrong answers and hallucinated framework features.
Context is often a problem
Deployment config was the worst of it. For AWS Amplify it would reel off hundreds of lines that were nonsensical or broken. I found myself typing "take into account the entire solution" and dragging every file in a folder into context to get anything usable.
The Ugly
Vulnerable recommendations
I asked Cursor to hash a password input using industry standards. It gave me this.
crypto.createHash("sha1")
SHA-1 has been broken for years, but that isn't even the main problem. A general purpose hash is designed to be fast, which is precisely what you don't want when someone is running a stolen database through a GPU. No salt either. The industry standard it was asked for is bcrypt, scrypt or Argon2, and it produced the one thing that would pass a code review by someone who'd never had to think about it.
Rabbit hole nonsense
The loop goes like this. It hallucinates a method name, I say "that's not a real method", it says "ah you are right, let's fix that", and it rewrites the entire file on some other tangent. I say "you've removed the XYZ feature, put it back", and back comes the same hallucinated method. Round and round, until I ran git reset --hard HEAD and started the whole thing again.
Where this leaves us
My AI sidekick was a hyped up junior developer, eager to rewrite the world. Quick and dirty solutions, fine for a prototype, nowhere near the consistency you need for something that has to run in production for five years. Give it boilerplate and grunt work and it earns its money. Don't sign off anything it writes without reading it.
And that is the part that worries me. If AI sits at the level of a junior developer, and companies respond by hiring seasoned developers with AI agents instead of juniors, the pipeline that produces seasoned developers quietly dries up. I still remember the pain of learning that very first tech. The struggle was the learning. Take it away and you don't get developers who skipped the hard part, you get people who never built the foundations to do the job at all.