In February 2025, AI researcher Andrej Karpathy described a new way of programming: you “fully give in to the vibes”, describe what you want to an AI, accept its changes, paste error messages back, and barely read the code. He called it vibe coding. The term spread quickly, became one of the defining phrases of the year, and now describes a spectrum of AI-first software creation — from weekend prototypes to startups built largely through prompts.

What vibe coding looks like

A typical session:

  1. Describe an app in plain language: “a habit tracker with a calendar view and reminders”.
  2. An AI tool — an app builder such as Lovable or Bolt, or an AI code editor — generates the interface and code.
  3. Try it, then describe changes: “make the buttons bigger”, “add login”, “it crashes when I delete a habit”.
  4. Repeat until it works well enough.

The person may never open most of the files.

Why it took off

  • Access: people without programming training can build working tools for themselves.
  • Speed: developers can prototype ideas in hours instead of days.
  • Better models: AI systems became capable of writing and fixing whole applications, not just snippets.
  • Integrated platforms: hosting, databases and authentication are connected automatically.

Where it works well

  • Prototypes and demos to test an idea with users.
  • Personal tools used only by you, with no sensitive data.
  • Internal one-off utilities such as a script to clean up files.
  • Learning: seeing how an app is structured, then studying the code.

Where it breaks down

Security

Code nobody reviews can contain serious vulnerabilities: missing access controls, exposed API keys, databases readable by anyone, unvalidated input. Several vibe-coded apps have publicly leaked user data because of such mistakes. The common web risks catalogued by OWASP — broken access control, injection, security misconfiguration — apply fully to AI-written code.

Maintainability

As an app grows, an AI that edits without a coherent design can produce duplicated logic and fragile structure. Each fix risks breaking something else, and debugging code you’ve never read is hard.

Hidden costs

Usage-based platforms, AI credits and hosting can grow quickly once real users arrive.

Correctness

Apps that look finished may mishandle edge cases — time zones, payments, concurrent users — that only show up in production.

Making vibe coding safer

  • Keep sensitive data out of prototypes until a developer has reviewed the code.
  • Use the platform’s built-in authentication and database security features, and ask the AI explicitly to enable row-level security or equivalent.
  • Ask the AI to review its own code for security issues — then ask a human too, for anything public.
  • Never put secret keys in front-end code.
  • Use version control so you can roll back.
  • Plan a handover: if the prototype succeeds, budget for an engineer to audit and restructure it.

The bigger picture

Vibe coding lowers the barrier to creating software, much as spreadsheets once let non-programmers build calculations. Professional developers increasingly use a disciplined version: AI writes most of the code, but humans set the architecture, review changes and own the tests.

Common mistakes to avoid

  • Launching publicly without a security review. If real people’s data is involved, someone who understands security must review the app first.
  • Copying secret keys into the app. Keys in front-end code can be extracted by anyone who opens the browser’s developer tools.
  • Endless prompt loops. If the AI keeps breaking one thing while fixing another, stop, roll back and describe the problem more precisely, or get human help.
  • Ignoring costs. Check how pricing scales with users and AI usage before you promote the app.

Key takeaways

  • Vibe coding means building software mainly by describing it to an AI and accepting its changes.
  • The term was coined by Andrej Karpathy in February 2025 and spread rapidly.
  • It excels for prototypes, personal tools and learning.
  • Unreviewed code brings real security, maintainability and cost risks.
  • Professional teams use a disciplined form: AI writes, humans design, review and test.

Frequently asked questions

Do I need to know how to code to vibe code?

Not to start. But basic knowledge of how web apps, databases and authentication work helps you spot problems and describe changes precisely.

Can a vibe-coded app become a real business?

Some have. Successful ones usually bring in engineers at some point to secure, restructure and scale the code.

Is vibe coding the same as no-code?

They overlap. No-code platforms use visual builders and configuration; vibe coding generates actual source code from conversation, which you can export and modify.