Vibe coding

Andrej Karpathy, a co-founder of OpenAI and former head of AI at Tesla, used the expression in a post on X on 2 February 2025. He described "a new kind of coding" where you "fully give in to the vibes" and forget that the code even exists. He accepted AI-proposed changes with "Accept All" without reading the diffs and pasted error messages back without comment, adding that it was not too bad for throwaway weekend projects.

The term spread quickly: Merriam-Webster listed it as slang and trending in March 2025, and Collins English Dictionary named it its Word of the Year 2025 on 6 November 2025. Today the word is often used loosely for any programming with AI, which causes confusion. Martin Fowler, for example, recommends keeping the two approaches apart.

It relies on a large language model (LLM) that turns a plain-language brief into code. A typical workflow looks like this:

1. Brief: you describe what the app should do, who it is for and how it should look. The quality of the brief matters as much as in any other AI work (see our guide on how to write prompts).
2. Generation: the AI tool writes the code and often runs it straight away in a preview.
3. Testing: you click through the result and look for anything that does not work or looks different from what you wanted.
4. Fixes: you describe the bug or change to the AI, or paste in the error message. You do not edit the code yourself.
5. Repeat: the loop continues until the result "mostly works".

People use web-based app generators as well as editors and agents built for programmers. For an overview of specific tools and their pricing, see our articles on AI website building and AI tools for developers.

The difference is not the tool but responsibility for the code. In vibe coding, the person does not read the code and only judges whether the app appears to work. In AI-assisted programming, a developer lets the AI write much of the code but reads and tests the changes, stores them in a version control system such as Git and understands what they deploy. Martin Fowler calls this approach agentic engineering.

For a business, the rule is simple: vibe coding is fine for validating an idea; software that more people will use or that handles data needs AI-assisted programming under a professional's control.

• Prototypes and idea validation: a clickable prototype shows customers or developers exactly what you want faster than a long specification.
• Personal and one-off tools: file conversion, a simple calculator, a spreadsheet clean-up script that only you use.
• Internal helpers without sensitive data: a small team tool that does not touch personal data, payments or access to other systems.
• Learning and experiments: a quick way to understand what is technically possible and roughly how much work it involves.

It is not suitable for online shops, client portals, apps with payments or personal data, or anything the business depends on. If you want to test a product on the market as an MVP, expect the code to need a review or a rewrite after a successful test.

• Security: in 2025 Veracode tested more than 100 language models on 80 coding tasks. In 45% of cases the generated code contained a security vulnerability, and the models failed to secure code against cross-site scripting (XSS) in 86% of cases.
• Data leaks: in May 2025 security researchers found that 170 of 1,645 examined apps built with Lovable let anyone access users' personal data, because database access permissions had not been set up. With an app like that, the business is liable under GDPR.
• Unwanted actions by AI agents: in July 2025 an AI agent in Replit deleted the live database of a project run by SaaStr's founder, despite an explicit instruction not to change anything. An agent with access to live data and no backup is an operational risk.
• Maintenance: code nobody has read grows fast and loses structure. Every further change becomes slower and more expensive, for people and for AI alike. And often nobody in the business understands the app when it breaks.
• Hidden bugs: an app may work in a demo yet miscalculate in edge cases, lose records or break after the next change request.

1. Separate prototype from production. Anything vibe-coded is a draft, not a finished system. A developer must review it before customers use it.
2. No live data or keys. Do not put real customer data, passwords or API keys into prototypes. Use test data.
3. Limit AI permissions. An agent should not have access to the live database, payment accounts or production server. Consistent access management helps.
4. Versioning and backups. Save every working version (Git or the tool's history) and back up data so you can roll back.
5. Security check before launch. Verify login, data access rights, form handling and library updates using a website security checklist.

Once an app is meant to serve customers, process personal data or connect to accounting, CRM or payments, it pays to build it, or take it over, under a developer's control. A vibe-coded prototype is still a useful starting point: it shortens the brief and reduces the risk of misunderstandings. In our web application development we use AI to speed up the work, but we review, test and secure every line of code before it goes live. For choosing the right AI approach for your business, see our AI solutions for businesses.