What is vibe coding? When to use it, risks, and how to do it with discipline

What is Vibe Coding?

Vibe coding is a way to build software by describing it in natural language to an AI code-writing model, then running it and asking AI to fix it, without carefully reading each line of generated code. The term was coined by Andrej Karpathy (co-founder of OpenAI, former head of AI at Tesla) in a post on X on February 2, 2025, and was chosen by Collins Dictionary as Word of the Year 2025. This 2026 update consists of four parts:

1. Karpathy's original definition and how it differs from AI-assisted programming.
2. When vibe coding is and isn't appropriate.
3. Documented risks, from Veracode's report to incidents at Lovable and Replit.
4. A disciplined process that real product teams can apply using Claude Code (Anthropic).

For example, a UI mockup tested in one afternoon fits vibe coding, but a payment page does not.

The more money, personal data, and running systems are involved, the more you need to review code. Diagram: OPCAIOS.

What is vibe coding?

According to Karpathy's original post, vibe coding is "a new kind of programming" where you "totally go with the vibe, embrace exponential speed increases, and forget that source code exists". He describes his own approach: talking to an assistant in the editor by voice so he barely touches the keyboard; asking for small things like "reduce the sidebar padding by half"; always hitting "Accept All" and no longer reading diffs; when errors happen, he pastes the entire error message without commentary. The code is "larger than his ordinary understanding", and he concludes it's "not bad for a weekend project you throw away when done, but still quite fun".

What conditions does the original definition have?

The original definition has two conditions: using AI to write code, and not reviewing the code. According to Wikipedia, Merriam-Webster added this term to its "slang and trending" section from March 2025, and Collins chose it as Word of the Year 2025 (the Collins page blocks automated access so we relied on news reports and Wikipedia). Collins defines vibe coding as using AI prompted in natural language to assist in writing computer code. Karpathy's original post has over 7.3 million views according to X data (checked 23/10/2026). For example, using Cursor (the tool Karpathy mentions) to create an intro page and then hit "Accept All" fits the original definition.

How does vibe coding differ from AI-assisted programming?

Vibe coding differs from AI-assisted programming in whether you read, understand, and take responsibility for the code. Programmer Simon Willison, in his post "Not all AI-assisted programming is vibe coding" (19/3/2025, accessed 23/10/2026), emphasizes this distinction: vibe coding is building software using a language model without reviewing the written code. He worries the term is being used for all kinds of AI-assisted coding, diluting the meaning and creating false impressions about what can be done responsibly. There are two main points of distinction:

1. AI-assisted programming: you read, test, and understand the results, and according to Willison that is not vibe coding.
2. Pure vibe coding: you accept results by feel, for example using Cursor to create a page and then hit "Accept All".

The table below compares five criteria:

Criterion	Vibe coding (original definition)	AI-assisted programming
Read diff and understand code	Don't read, "Accept All"	Read, understand, edit
Error handling	Paste error to AI, try until it works	Find root cause, write tests
Responsibility for code	You accept the result by feel	You are responsible for each line
Fits with	Test projects, prototypes, weekend toys	Real products, running systems
Main risk	Vulnerabilities, unmaintainable code	Lower if code review is good

What does a typical vibe coding process look like?

The process is usually a short loop: describe what you want, let AI write it, run it, then paste the result or error back to AI to fix. The tools Karpathy mentions are Cursor Composer running the Sonnet model and SuperWhisper voice input; nowadays many people use agents like Claude Code or Codex, or app-building platforms like Lovable and Replit (per Wikipedia). The common thread: the person mainly "looks, speaks, runs, and pastes" instead of writing syntax.

This loop is extremely fast for things that need a UI, a small script, or a prototype to see if an idea is worth pursuing. It stops working when the code gets large enough that nobody understands it, because when AI gets stuck, you no longer have enough knowledge to guide it.

When to and When Not to Vibe Code

I should vibe code when the consequences of small errors are minor and code can be thrown away; I shouldn't when a single mistake means losing money, losing data, or exposing user information. According to Simon Willison (March 19, 2025), the boundary lies in whether I review the code or not. First, here are three suitable cases:

1. Prototypes to test ideas and interfaces, weekend projects, tools only I use.
2. One-time scripts to transfer or clean up unimportant data, then discard.
3. Learning: watching AI solve a problem, then reading to understand.

Next are three cases I shouldn't do, or at least must review thoroughly:

1. Login, permissions, payments, invoicing. See how to handle safely in What is Webhook? and What is Stripe?.
2. Anywhere that stores customer personal data. With databases, understand row-level access (RLS) in What is Supabase? before opening to real users.
3. Systems running for customers and deployment operations.

For example, asking Claude (Anthropic) to build a landing page prototype is reasonable; asking it to fix payment calculation code requires reading every line.

Are There Any Numbers on Vibe Coding Risks?

Vibe coding risks fall into three documented groups: security vulnerabilities, incidents caused by AI agents, and hard-to-maintain code. The first group has the clearest numbers. Veracode's GenAI Code Security 2025 report (published July 30, 2025) records that Veracode's research team analyzed 80 selected coding problems across over 100 large language models and found three results:

1. AI-generated code has security vulnerabilities in 45% of cases.
2. When given a choice between safe and unsafe approaches, models choose the unsafe way 45% of the time, and security effectiveness doesn't improve over time despite increasingly correct syntax.
3. AI misses 86% of cross-site scripting (XSS) injection errors.

Note: the 45% figure applies to problems in the study, not all AI-written code, and the report comes from a company selling security solutions. For example, a login page written by AI still needs human review before opening to customers.

What Incidents Have Happened When Giving Authority to AI?

There are three documented examples, according to Wikipedia (compiled from news sources, checked October 23, 2026) and under the "Vibe coding" heading (Wikipedia):

1. Application data leak. In May 2025, the app-building platform Lovable was reported to have a vulnerability in its generated code: 170 out of 1,645 web apps created by Lovable had errors allowing anyone to access personal information.
2. Agent corrupts system. In July 2025, the founder of SaaStr recorded Replit's AI agent deleting a database despite being explicitly instructed not to change anything.
3. Hard-to-maintain code. Karpathy himself admitted code "larger than normal comprehension ability"; for whoever maintains it later, that's technical debt.

The first two examples come from Wikipedia so treat them as illustrations, not general statistics about all vibe coding products.

How to Do Vibe Coding with Discipline

Vibe coding with discipline is a way to keep AI's speed while putting back the guardrails that "Accept All" throws away. The first four habits below are real experience from OPCAIOS using Claude Code (Anthropic) to build websites, and match, according to Simon Willison (19/3/2025), the spirit of distinguishing vibe coding:

1. Write the request first: a brief summary of the goal, limits, and what not to touch; AI does well when there are rules, as in AI writes code in the wrong version.
2. Do small steps, with git: each change one commit so you can go back. With a shared repo, only commit the files you actually fixed.
3. Read diff at sensitive places: login, permissions, payment, handling personal data, anything touching the database.
4. Have automated tests and checks: so AI can run them and read the results instead of trusting the "done" report.

For example, before asking AI to fix a payment page, write clearly in the request that you cannot touch the price config file.

How should secrets, permissions and backups be handled?

The next four habits protect real data and running systems, from OPCAIOS experience:

1. Keep secrets out of code: put API keys and passwords in environment variables, never paste them into prompts or code running in the browser.
2. Grant least permission: if an agent only needs to read then don't give it write; if you need to connect tools, see What is MCP? on the principle of least privilege.
3. Back up before letting an agent touch real data, and test every destructive action on a test environment.
4. Do a dry run before deploying and check the build result: our real lesson on 23/10/2026: one deploy with rsync --delete from a local copy deleted a file that another session had just added on the server, breaking the build (website still ran the old version thanks to the seamless rollback mechanism). Since then we always pull the latest, do a dry run with --dry-run to see if there are any deleting lines, then only deploy.

Choosing the model also matters: hard tasks, many files need a strong model; small work can use a cheaper model. See Which AI model should you choose?.

Can someone who doesn't know how to code do vibe coding?

Yes, with small products and for your own use. Wikipedia notes that supporters say vibe coding helps amateur programmers make software without long software engineering training, while critics worry about lack of accountability, hard maintenance, and security risks. One practical way is to make a prototype with vibe coding to test the idea, then if you want to give it to real customers, ask someone with expertise to review security, or learn enough to review it yourself. The kinds of work you should hand to experts or check most carefully are login, payment, and personal data.

Read more: Claude Code (or a coding agent) for people who don't know code; Guide to using Cursor AI and Lovable to build your own Micro-SaaS/Landing Page without knowing code.

Frequently Asked Questions

What is vibe coding?

It's a way of making software by describing it in natural language to AI to write code, then running it and asking AI to fix it, without carefully reading the code. The term was coined by Andrej Karpathy on 2/2/2025 and is Collins Word of the Year 2025.

How is vibe coding different from programming with AI assistance?

Vibe coding by definition means not reviewing the code AI writes. Programming with AI assistance means the programmer reads, tests, and understands the code, then takes responsibility for it.

Is vibe coding safe?

Not automatically. According to the Veracode 2025 report, code written by AI had security vulnerabilities in 45% of the problems tested, and security effectiveness didn't improve over time. For anything involving login, payment, or personal data, you need to review the code.

When should you use vibe coding?

When the consequences of errors are small and the code can be thrown away: prototypes, weekend projects, personal tools. Don't use pure vibe coding for real systems with money or customer data.

How do you use AI to write code for a real product?

Keep the speed of AI but add clear requirements, commit step by step, read diffs in sensitive places, have tests, keep secrets out of code, back up and test before deployment. To learn this process, see OPCAIOS's AI application training course.

Source: Andrej Karpathy's original post on X (2/2/2025); Simon Willison's "Not all AI-assisted programming is vibe coding" (19/3/2025); Veracode's GenAI Code Security 2025 report press release (30/7/2025); Wikipedia "Vibe coding" (Collins, Merriam-Webster, Lovable and Replit incidents, compiled from press sources; checked 23/10/2026); Collins blocks automated access so information about Word of the Year is based on press reports. Process experience is OPCAIOS's. Numbers may change over time.