Vibe coding explained: what it is, what it isn’t, and what it costs
Every few months a new term lands in the developer conversation and immediately gets stretched beyond recognition. Vibe coding is the current example. The phrase has a precise origin, a specific meaning, and a growing body of evidence attached to it. Most of the discourse ignores all three.
Here is what the term actually covers, where it breaks down, and what the numbers say.
What Vibe Coding Actually Means
Vibe coding is a software development method where a person describes what they want in plain language, an LLM produces the code, and the result is judged by whether it appears to run. The defining condition is that the operator does not read the generated code line by line.
That last part is the whole thing. Someone who reviews and understands every generated change is doing AI-assisted programming. Vibe coding is specifically the case where that review step is deliberately skipped.
Andrej Karpathy, a founding member of OpenAI and former director of AI at Tesla, coined the phrase in a post on X on 2 February 2025. He described work in which the operator would “fully give in to the vibes” and stop reading diffs. He framed it as suited to throwaway weekend projects, not production systems. Most subsequent usage dropped that qualification.
The dictionary caught up fast. Merriam-Webster added it as a slang and trending entry on 8 March 2025. Collins named it Word of the Year on 6 November 2025, citing a surge across its 24 billion-word corpus.
How the Loop Works
Sessions run in one of two environments. The first is an agentic editor or CLI tool on a local file system: Cursor, GitHub Copilot, OpenAI’s Codex, or Anthropic’s Claude Code. The second is a hosted builder that owns the whole stack, like Replit, Lovable, Google AI Studio, or Vercel’s v0.
Local tools leave a repository you can inspect and version. Hosted builders often leave only a deployed service, which is why security teams treat vibe-coded applications as a provenance problem, not just a code quality problem.
The loop has four steps: state a goal, the model writes or edits files, the tool builds and runs the result, you look at the output and describe what looks wrong. Repeat. Error messages are frequently pasted back verbatim on the assumption the model will interpret them.
Settings determine how much control you keep. Auto-accept applies every proposed diff without confirmation. Planning modes force a written plan before any file is touched. Context files, conventionally named AGENTS.md or CLAUDE.md, carry instructions across sessions. Turning auto-accept on and the rest off is roughly what separates vibe coding from supervised agentic development.
Claude Code diverged from earlier assistants by combining read-write file access with Unix shell execution. It had reached 115,000 developers processing 195 million lines weekly by July 2025, according to Anthropic data. On the billing side: Google added spend caps to AI Studio in March 2026 after developers reported charges some put above $70,000.
️ Three Things Vibe Coding Is Not
The term gets conflated with related but distinct practices. The distinctions matter when you are reading adoption statistics.
- AI-assisted programming is the superset. Programmer Simon Willison has argued that reviewing, testing, and understanding generated code makes the model a typing assistant rather than a vibe coding session. Most professional use sits here. Adoption statistics for AI coding tools should not be read as vibe coding statistics.
- No-code and low-code platforms predate the term. They expose fixed component libraries and visual editors. The artifact is configuration inside a vendor runtime. Vibe coding produces source code, even when nobody reads it.
- Spec-driven agentic development inverts the posture: the agent still writes the code, but a specification, tests, and review gates constrain it. Andrew Ng objected in June 2025 that the vibe framing misrepresents a demanding activity as a casual one.
What the Productivity Research Found
The productivity case is messier than the vendor marketing suggests.
METR published a randomized trial on 10 July 2025 covering 16 experienced open-source maintainers and 246 real tasks. Participants expected AI assistance to make them 24 percent faster. They were measured at 19 percent slower. Afterwards, they still estimated they had gained 20 percent speed. The perception gap is as notable as the performance gap.
UC San Diego and Cornell University research released 5 January 2026 surveyed 99 professional developers. All 13 observed participants controlled software design themselves. Of 65 respondents, the majority named prior engineering expertise as a prerequisite for working with agents. The top tools cited: Claude Code (58 respondents), GitHub Copilot (53), and Cursor (51).
Anthropic’s own research found developers using AI assistance scoring 17 percent lower on comprehension tests while completing tasks marginally faster. LiveCodeBench Pro, released 13 June 2025, measured frontier models at 53 percent accuracy on medium-difficulty problems and zero percent on hard ones without external tools. Stanford researchers argued in June 2025 that such evaluations overstate gains by excluding oversight costs.
The counter-evidence is real but individual. A Google principal engineer described Claude Code reproducing in one hour architecture her team had spent a year on, attributing the gap to organizational bottlenecks rather than raw model capability.
The Security Evidence
The security record is specific and documented.
Veracode tested more than 100 models across 80 security-sensitive tasks and reported on 30 July 2025 that 45 percent of generated samples introduced an OWASP Top 10 vulnerability. Java failed roughly 72 percent of tasks. Cross-site scripting defenses failed in 86 percent of relevant samples. An October 2025 update found newer and larger models writing functionally better code without writing safer code. Veracode sells application security testing, a commercial interest worth weighing against the results.
Semafor reported in May 2025 that a scan of 1,645 Lovable-built applications found 170 exposing personal data, cataloged as CVE-2025-48757. In July 2025, an agent on Replit deleted a production database during a stated code freeze. Replit’s CEO publicly called it unacceptable and shipped development and production separation shortly after. CodeRabbit examined 470 open-source pull requests in December 2025 and reported 1.7 times more major issues in AI co-authored code, with security vulnerabilities 2.74 times higher.
Maintainability degrades more quietly. GitClear analyzed 211 million changed lines from 2020 to 2024 and found refactoring falling from 25 percent of changed lines to under 10 percent, with copy-pasted code exceeding moved code for the first time in two decades.
Why Marketers Are in the Conversation
Marketers are an explicit target market, not a side effect of developer tooling.
Semrush embedded its search dataset inside Lovable on 13 May 2026, putting 28 billion keywords and 43 trillion backlinks into the build surface rather than a separate subscription. Replit integrated RevenueCat on 9 April 2026 so subscriptions and app store billing arrive by prompt. Google rebuilt AI Studio around conversational app creation on 26 October 2025, targeting developers, marketers, and non-coders in the same product.
The workloads that migrate first are internal: pacing dashboards, feed quality checks, tag audits, one-off landing pages, reporting scripts. Anthropic documented its own marketing operations team compressing a weekly metrics report from two days to two hours on 8 July 2026 using the Cowork agent released in January for non-developers. That account is both evidence and marketing.
Appetite is not trust. StackAdapt research found only 6 percent of marketers act on in-platform AI recommendations. An application built in an afternoon by someone outside engineering may hold customer records, API credentials, and spend data with no review, no inventory, and no owner. Gartner’s May 2025 report projected that prompt-to-app adoption by non-developers could raise defects 2,500 percent by 2028 without governance.
The second-order effect on the publisher side is already visible. Tailwind CSS laid off 75 percent of its engineering team on 6 January 2026 after documentation traffic fell roughly 40 percent and revenue by 80 percent, because assistants now answer the questions that once drove visits. Stack Overflow recorded 1,442 new questions in July 2026 against a 2014 peak of 207,204.
The Distinction Worth Preserving
Gartner projected in May 2025 that 40 percent of new enterprise production software will be created with vibe coding techniques by 2028, while separately warning about a potential 2,500 percent defect increase without governance. Those two projections existing in the same report tells you something about the current state of the conversation.
Karpathy’s framing excluded production work. Ng rejects the label. Vendors now sell governance for a practice defined by the absence of it. As of August 2026, the phrase is used both literally and as a loose synonym for AI-assisted development. That distinction is worth preserving every time you read a statistic attached to it.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
