Can You Vibe Code an OS Without Lying to Yourself?

I am currently experimenting with AI agents to assist in the development of an operating system named ShrekOS. The initial results are uncertain, as I am not entirely confident in my understanding of every line of code generated by these agents. ShrekOS currently boots, updates itself, and isolates agents, but a significant portion of its implementation is the result of agents working within a framework I defined.

Every component of an operating system plays a critical role and failure in any of these areas can lead to a machine that either cannot boot or, worse, functions incorrectly without the system administrator noticing. This is especially true for components responsible for trust, permissions, networking, updates, rollback, hardware support, sandboxing, persistence, installer behavior, kernel assumptions, and hardware support.

A mistake in any of these areas can have catastrophic consequences, making it clear that vibe coding a simple application is acceptable, but vibe coding an operating system is a different matter entirely.

The question is not whether AI can generate an operating system, but rather at what point does vibe coding stop being a productivity boost and start being irresponsible due to the foundational nature of the system being developed. I am skeptical about the notion that AI-generated code can be blindly trusted, as it may lack the necessary understanding and auditability that human developers can provide.

While abstraction and tooling have historically allowed for successful OS development, the complexity introduced by AI-generated code may surpass the ability of even the most seasoned engineers to fully audit and ensure correctness.

However, the counterargument is that no one can fully understand an entire modern OS stack, and real engineering has always relied on abstraction and trusting layers they did not write. An operating system is just a larger-scale example of this, and relying on invariants, test suites, signatures, isolation, and threat models can help mitigate the risks associated with AI-generated code.

The real challenge lies in establishing robust proof mechanisms to ensure that the AI-generated components behave as expected, even if the underlying code is not fully comprehensible.