What Is Vibe Coding? Meaning, Origin, Risks and When It Works

Vibe coding is building software by telling an AI what you want in plain language and accepting the code it produces without reading it. You run the result, describe what's wrong, paste in error messages and repeat until it seems to work. Andrej Karpathy coined the term on 2 February 2025, and Collins Dictionary named "vibe coding" its Word of the Year for 2025. It is great for quick prototypes and personal tools, and risky for anything that handles real users, money or data.

Updated October 2026.

Where the term came from

Karpathy, a founding member of OpenAI and later Director of AI at Tesla, described it in a post on X:

"There's a new kind of coding I call "vibe coding", where you fully give in to the vibes, embrace exponentials, and forget that the code even exists."

In the same post he wrote "I "Accept All" always, I don't read the diffs anymore," and added that "It's not too bad for throwaway weekend projects." That last line is often dropped when the term is quoted, but it was part of the original meaning: vibe coding was a way to play, not a method for production software.

The phrase spread fast. On 6 November 2025, Collins Dictionary made it Word of the Year, defining it as "the use of artificial intelligence prompted by natural language to write computer code."

A year after the original post, on 4 February 2026, Karpathy called it "a shower of thoughts throwaway tweet" and said his current favourite term for the professional version is "agentic engineering": "agentic" because "you are not writing the code directly 99% of the time, you are orchestrating agents who do and acting as oversight."

Vibe coding vs AI-assisted coding

The most useful distinction comes from developer Simon Willison, who defines vibe coding as "building software with an LLM without reviewing the code it writes." By that test, most professional use of AI coding tools is not vibe coding at all.

Willison's personal rule is a good line to borrow: "I won't commit any code to my repository if I couldn't explain exactly what it does to somebody else."

How people vibe code

A typical session looks like this:

1. Describe the app. "Build a web page where I can track my running times, with a chart by week."
2. Let the AI build it. A chat app, an app builder or a coding agent such as those in our best AI coding assistant guide writes every file.
3. Run it and react. If something is broken, paste the error or describe the problem ("the chart is empty") and let the AI fix it.
4. Accept all changes. No reading diffs. Keep going until it does what you want.
5. Ship or share it, often without tests.

A simple starting prompt might be:

Build a single-page app in plain HTML and JavaScript that tracks my running
times. Store entries in localStorage. Show a weekly bar chart. Keep it in one
file so I can open it directly in a browser.

Prompts like this work well because the scope is small, the data stays on your machine and a mistake costs little.

The risks

Security holes you can't see

This is the big one. Veracode's 2025 GenAI Code Security Report tested more than 100 LLMs on 80 coding tasks and found security flaws "in 45 percent of cases." Java had a failure rate "over 70 percent," and models failed to defend against cross-site scripting and log injection in 86% and 88% of relevant cases. Veracode also found security performance "remaining unchanged over time," even as models got better at writing code that runs. If nobody reads the code, nobody catches these flaws. Our guide to AI agent security covers the wider risks of letting agents act unsupervised.

Bugs that look like features

AI models can produce code that works for the demo and fails on edge cases, or that calls functions and packages that don't exist (a form of AI hallucination). When you don't read the code, you find out from users.

Code nobody can maintain

A vibe-coded app grows by patches on patches. When it breaks in a way the AI can't fix, you're left with a codebase nobody understands, including you.

Secrets and data exposure

Pasting API keys into prompts, committing them into code, or building apps that store personal data without access controls are common mistakes when nobody reviews the output.

When vibe coding works

Vibe coding is a good choice when all of these are true:

• It's for you or a small trusted group. Personal tools, internal one-offs, a weekend game.
• Mistakes are cheap. No payments, no personal data, no production systems.
• It's a prototype to learn from. Building a rough version to test an idea, then rebuilding properly, is a sensible use.
• You can throw it away. Karpathy's original framing: throwaway weekend projects.

It is a poor choice for anything public-facing, anything handling logins, payments or personal data, and anything you'll need to maintain for years.

How to vibe code more safely

If you're going to do it, a few habits remove most of the danger:

1. Keep scope small and data local where you can.
2. Ask the AI to write tests and run them, even if you don't read the code.
3. Ask for a security review in a fresh session: "Review this code for security issues, especially input handling, authentication and secrets."
4. Never paste real secrets into prompts or code; use environment variables.
5. Use version control so you can roll back when a fix breaks something else.
6. Give the AI good context: a short file describing the project, its rules and its stack. This is context engineering, and it matters more than clever prompts.
7. Graduate to review before anything goes public. That is the point where vibe coding should become AI-assisted engineering.

Even teams that use AI for most of their code keep humans in the loop. Anthropic's Claude Code team says Claude writes about 90% of Claude Code's code, yet every pull request gets an AI review, a risk classifier decides how many humans must approve, and "You land it, you own it." That is the opposite of forgetting the code exists, and it's why their approach works for production.

The bottom line

Vibe coding means letting the AI write code you don't read. It is a real and useful way to build quick prototypes and personal tools, and it brought programming to people who never wrote code before. For anything that matters, add tests, review and human ownership, which turns vibe coding into what Karpathy now calls agentic engineering.