Over the past year, anyone who has written code with AI has probably lived through these three things: you ask the AI to rewrite a decade-old module in a different language, and it runs by that afternoon; a small feature request that could never win development resources gets turned into a working tool almost in passing; and in the code-review queue sit thousands of lines of generated code that no one has read and no one can explain.
Three views of it: Vibe Coding (we prefer to call it AI Coding) is doing software renovation, or engineering reinvention, or piling up garbage code. Each view digs in at its own corner, and none can win the others over. Our take: all three are right — and it's precisely because all three are right that the question is worth taking apart with care.
1. Three Narratives, Each with Its Own Evidence
The renovation view sees one of the AI's essential traits: it is retelling, in a different language, what it learned from the corpus. The parsers, adapter layers, and CRUD that human programmers wrote over decades — it has seen them all; you want it in Go, it gives you Go; you want it in Rust, it gives you Rust. This is no put-down. The daily work of the software industry has always been full of exactly this kind of repetitive labor: format conversion, interface adaptation, legacy-system migration. It's the same house; you just rerun the plumbing and wiring, and it comes out a good deal brighter — the value of renovation is real and measurable, and its boundary is clear: it does what humanity as a whole already knows how to do.
The reinvention view sees the other side: steel to architecture. In the age of load-bearing masonry, a building rose only a few stories; only after steel-frame construction arrived did skyscrapers and long-span bridges become possible. What a new material changes was never how fast you build the same house — it's what kind of house you can build at all. The same thing is happening to AI in software engineering: the unit of delivery shifts from lines of code to intent and acceptance criteria, and software that would never have been greenlit before because of labor cost — one-off tools, customization tailored to every individual, verification scripts written and thrown away on the spot — is becoming an everyday thing.
The garbage view has evidence just as solid, and it fits in a single sentence: the output is massive, and the quality can't be guaranteed. Hallucinated APIs delivered with a perfectly straight face, changes merged without so much as a glance, technical debt piling up at machine speed, and more and more conversations that go like this — "Who wrote this?" "The AI did." "Can anyone explain why it's written this way?" Silence. Code that no one understands and no one is responsible for is garbage, whether or not it runs.
2. The Deciding Factors: Model, Person, and the Harness That Works with Them
The same model, in different hands, meets three different fates; and the same pair of hands, given a different model, can just as sharply come out ahead or behind. So this isn't a one-answer question — what decides whether you get renovation, reinvention, or garbage is three things: the model, the person using it, and the harness that works with the person.
The model is the material. The strength of the steel sets the ceiling on the building: in the age of masonry, even the finest craftsman couldn't raise a skyscraper; a weak model with the best process in the world is still only good for renovation, never reinvention. Every upgrade in the material genuinely raises the ceiling.
The person is the engineer. Where to build, what counts as up to standard, which lines must never be crossed — these judgments are domain knowledge and engineering taste, and no material, however good, can replace them.
The harness is the engineering discipline, and its job is to turn effort into direction: draw up a plan first, then act once it's confirmed; every step approvable and auditable; verification and a retrospective once the work is done. In "A Specialized Harness Beats a General-Purpose One" you can see the harness measured: give the same model a specialized harness, and its security-detection scores multiply — the model matters, and the harness matters too.
With all three assembled, massive output can finally earn the massive acceptance-checking it deserves, and AI is reinvention; the stronger the model while the person and the harness are absent, the faster garbage gets generated. In "The AI Coding Maturity Curve" we wrote about the peak of the third stage — "hitting enter without looking at the diff" — and the place where garbage starts to pile up is exactly the second the person lets go of the harness.
3. In the Face of Threats, Code Isn't Just Debt — It's an Attack Surface
In an ordinary industry, bad code is technical debt you can pay down slowly. But in the face of threats, code is more than technical debt or garbage — it's an attack surface, and someone will come to collect on it at once. A snippet that casually writes a secret key into the logs, a dependency pulled in without anyone reviewing it, a bit of input parsing thrown together on a "good enough to run" basis — elsewhere these are hidden hazards; in an adversarial environment they're an invitation.
So when we built AVL Code, what we built was a harness custom-made for security work.
Facing an attack surface, first take full stock of what you have. What the SBOM toolset does is exactly "get the facts out first": sbom.generate scans the dependency manifests, automatically recognizing 16 ecosystems and 22 manifest formats, and produces standard bills of materials such as CycloneDX / SPDX; sbom.audit checks each component against the OSV vulnerability database, grades by CVSS, and always pins CISA KEV known-exploited vulnerabilities to the top; sbom.vex then uses symbol-level reachability analysis to answer "can this vulnerability actually be reached in my code at all," collapsing the noise of "installed but never called" into a standard OpenVEX conclusion — the whole thing can run offline, usable even on an air-gapped network. That "dependency pulled in without anyone reviewing it" now has a record to check and grounds to judge by. For the same "find out first, then act" approach in the field, there are two more cases: Antiy IEP EPP automated inspection and CVE vulnerability scanning and MLPS 2.0 baseline compliance check.
Facing the garbage, make the AI stand on facts and goals at every step. On the facts side, the code-intelligence toolset is built on LSP, letting the AI find definitions, find references, and read compiler diagnostics the way an IDE does, instead of guessing with regex; and this evidence-led way of working isn't limited to code — in Network fault analysis for a complex business system, a five-year-old network ailment that had never been directly pinned down was walked step by step to its root cause from the evidence in a 2.2GB packet capture. On the goals side, the /goal command nails the goal into the session so that every round drives toward it, and you can even set a step budget; long-horizon tasks are handed to background subagents to run in parallel and can be recovered after a crash — Multi-agent parallel analysis of an Android banking trojan runs on exactly this parallel mechanism. The output may be massive; the rails it runs on stay under control the whole way.
As a backstop, there are those few old rules: for anything sizable, draw up a plan first and act only once you've confirmed it, then self-assess when it's done; every tool call approvable and auditable; the samples/ read-only analysis zone is a hard line that cannot be lifted. We even post our AI sessions on the official site exactly as they happened — we dare to make the process public because the process itself holds up to inspection.
The Answer: Look at the Model, the Person, the Harness
Is AI Coding renovation, reinvention, or piling up garbage? All three. The steel decides how high the building can go; the engineer and the discipline decide whether what rises is a tower or a ruin — the model, the person, the harness: let any one of the three go missing, and the answer slides toward the garbage end.
The question is about AI, but the answer has to be found in three places at once: which model you pick, which person you hand it to, and which harness you fit it with.
At avlcode.cn we're riding our donkey, in a harness that fits just right — waiting for you.
AVL Code — the AVL security engine, with intelligence at your side. From the Antiy Landi team.