Vibe Coding

What Is Vibe Coding?

Vibe coding is building software by describing what you want in natural language and accepting the AI-generated code without reviewing or fully understanding it. You judge the result by whether it appears to work, trading rigor and comprehension for speed. The term comes from a 2025 observation by Andrej Karpathy that developers could now "forget that the code even exists."

Key Takeaways

• The defining move is accepting code you have not read. Prompting an agent and then reviewing the diff carefully is agentic coding, not vibe coding.
• It is a legitimate mode for prototypes, throwaway scripts, and personal tools, where the cost of a hidden bug is near zero.
• The debt is invisible until it is not. Every unread merge adds comprehension debt, and the bill arrives during the first serious incident, when nobody on the team understands the system they operate.
• Security is the sharpest edge. Unreviewed generated code ships with unvalidated inputs, leaked secrets, and hallucinated dependencies that no one checked for slopsquatting.

How It Works

The workflow is a tight conversational loop. You describe a feature, the model or an AI coding agent produces the code, you run the app, and you react to what you see. If something breaks, you paste the error back and ask for a fix. You steer entirely by observed behavior: does the page load, does the button work, does the output look right. The source is treated as an artifact the machine manages, roughly the way most developers treat compiler output.

This works surprisingly well for greenfield projects with visible behavior, which is why vibe coding took off with landing pages, dashboards, games, and internal tools. The feedback you need is on the screen. It degrades fast when correctness is invisible: concurrency, security, billing logic, data migrations. There, code can look right, demo right, and still be wrong, and by definition nobody is reading closely enough to catch it. Developers already know the shape of this problem: in the 2025 Stack Overflow survey, 66% named AI solutions that are almost right but not quite as their top frustration, and 45.2% said debugging AI-generated code takes more time [1].

The failure mode compounds over time. Because no one holds a mental model of the codebase, each new prompt gives the model less coherent material to build on. Generated fixes patch symptoms, duplicate logic accumulates, and eventually the project reaches a state where neither the human nor the model can move it forward without a rewrite.

Example

A founder vibe codes a waitlist app over a weekend: signup form, referral links, an admin page. It works, and it ships. Three weeks later a user discovers the admin page is reachable without authentication, because an early prompt scaffolded the route before auth existed and no later prompt ever revisited it. Nothing "broke" in testing, since testing meant clicking through the happy path. The gap sat in code nobody had read. The fix took ten minutes; knowing the vulnerability existed was the part vibe coding could not provide.

What People Get Wrong

The mistake runs in both directions. Detractors treat vibe coding as a slur for all AI-assisted development, which misses that reviewed, verified agent output is a different practice with a different risk profile. Enthusiasts make the opposite error and carry the vibe workflow into production systems, assuming that "it has worked so far" is evidence of correctness. The feeling of speed deserves particular suspicion: in METR's 2025 randomized trial, experienced developers using AI tools took 19% longer on real coding tasks, yet still believed afterward that AI had sped them up by 20% [2]. The honest framing is scope-based: vibe coding is a fast, cheap mode for code whose failure does not matter, and an unpriced liability everywhere else.

FAQ

Where does vibe coding meaning come from? Andrej Karpathy coined the phrase in early 2025 to describe giving in to the model, accepting its output wholesale, and steering by results rather than by reading code. It spread quickly because it named something many people were quietly already doing.

Is vibe coding bad? It depends entirely on the blast radius. For prototypes, experiments, and personal tools it is a rational trade. For anything handling money, user data, or uptime commitments, unreviewed code is unmanaged risk, whatever generated it. Practitioners themselves are wary: the 2025 DORA survey found 30% of technology professionals report little or no trust in AI-generated code, even as 90% use AI at work [3].

How do teams stop prototypes from becoming vibe-coded production systems? With an explicit promotion gate. Before a prototype takes real traffic, it gets real review: a security pass, tests around the critical paths, and a human who can explain how it works. Some teams regenerate the system from a proper spec instead of hardening the prototype, which is often cheaper than auditing code nobody understands.

Sources

1. Stack Overflow Developer Survey 2025. "66% of developers cite AI solutions that are almost right as their top frustration; 45.2% say debugging AI-generated code is more time-consuming." https://survey.stackoverflow.co/2025/ai. Accessed August 2026.
2. METR. "Developers using AI tools took 19% longer on real tasks yet believed AI sped them up by 20%." https://metr.org/blog/2025-07-10-early-2025-ai-experienced-os-dev-study/. Accessed August 2026.
3. Google Cloud / DORA 2025 State of AI-assisted Software Development. "30% of technology professionals report little or no trust in AI-generated code; 90% use AI at work." https://cloud.google.com/blog/products/ai-machine-learning/announcing-the-2025-dora-report. Accessed August 2026.