What is vibe coding?

Karpathy described a way of working in which he accepts the AI’s changes without reading them, pastes error messages back with no comment and can “forget that the code even exists.” That’s “not too bad for throwaway weekend projects,” he wrote (Simon Willison, Mar 19, 2025). Collins Dictionary chose the phrase as its Word of the Year on November 6, 2025, and describes it as using AI, prompted by natural language, to write computer code (Collins Dictionary, Word of the Year 2025).

Since then, the term has been used in two senses:

• In the broad sense, generating any software from AI prompts counts as vibe coding. Stack Overflow used this definition in its 2025 developer survey (Stack Overflow, 2025 survey).
• In the narrow sense, it’s only vibe coding if nobody reviews the code. Developer Simon Willison draws the line at the point where someone reads AI code, tests it and can explain it. For him, that’s software development.

This article uses the narrow sense. For your software project, what matters is whether someone has reviewed the code. Our guide to SaaS explains how a SaaS project runs from idea to operations.

The numbers in the “Source” column refer to the list of sources at the end of this article. Our low-code vs. custom development comparison shows what a platform can do without programming and where it reaches its limits.

• Working doesn’t mean secure. The SusVibes benchmark gives AI agents 186 tasks from real open-source projects. For each of these tasks, human developers had previously committed an implementation with a vulnerability. With the functionally strongest combination, 57% of the solutions were functionally correct, but only 11.8% were both correct and secure. Hints about possible vulnerabilities in the task barely helped (Zhao et al., ICML 2026).
• A vendor’s own test finds plenty of vulnerabilities, too. Veracode, which makes code security tools, found a known vulnerability in about 38% of tasks in October 2026, down from about 44% in July. The tasks gave no security-specific guidance. The average security pass rate rose from 56% to 62%. Veracode says the gain came mostly from one type of vulnerability, cross-site scripting; the other three types it tests barely moved (Veracode, Oct 29, 2026).
• People overrate the result. In a user study, participants with an AI assistant wrote significantly less secure code than those without one and were more likely to believe it was secure (Perry et al., CCS 2023). The model used back then is out of date. In our view, the danger of false confidence remains.
• Invented packages open attack paths. AI models name software packages that don’t exist. On average, at least 5.2% of the packages from commercial models and 21.7% of those from open-source models were invented (Spracklen et al., USENIX Security 2025). The German Federal Office for Information Security (BSI) and the French Cybersecurity Agency (ANSSI) call this a novel attack vector (BSI and ANSSI, Sep 2024).
• Missing access rules can affect an entire platform. According to the CVE record, attackers could read and change database tables of websites generated on one AI app builder until mid-April 2025 without signing in, because the database’s row-level security policies were insufficient. The record rates the vulnerability as critical: 9.3 out of 10 on the Common Vulnerability Scoring System (CVSS). The vendor disputes it, on the grounds that each customer is responsible for protecting its own data (CVE-2025-48757, CVE Program record). Our article on the security risks of multi-tenant software shows how to get such rules right.
• Agents need limits. In one documented case, an AI agent reportedly deleted a production database despite a code freeze (AI Incident Database, incident 1152). So separate development from production before an agent gets access.

One study compared 806 open-source projects that adopted an AI editor with agents against similar projects that didn’t. In the first month, the number of new lines of code rose three- to fivefold, but after two months the advantage was gone. According to the main estimate, static analysis warnings rose by 30% and complexity by 41%, and both increases lasted (He et al., MSR 2026).

A second study analyzed about 302,600 AI commits from 6,299 projects. Most of the issues it found were signs of poor structure known as code smells. Of the tracked issues that AI introduced, 22.7% still exist in the latest version (Liu et al., 2026 preprint).

An experiment with 151 participants, 95% of them professional developers, points the other way. They added a feature to an application with or without AI, and others then developed the result further without AI. There were no significant differences in time or code quality (Borg et al., 2026 preprint).

In our view, these findings fit together once you ask who understands the code. In the experiment, professionals worked with an assistant. With vibe coding, nobody understands the code, so anyone who wants to change it later first has to work out what it does. Code like that is a form of technical debt: it runs, but the next change gets expensive. Our cost guide How much does software maintenance cost? covers what ongoing maintenance costs.

In METR’s first study, 16 experienced developers worked on 246 tasks. They expected AI to speed them up by 24% and still believed afterward that it had sped them up by 20% (METR, Jul 10, 2025). METR now calls those results out of date. The follow-up found about 18% shorter times among the original participants and about 4% among newly recruited ones, both with confidence intervals that include zero. METR calls the data an unreliable signal: significantly more developers than before declined to take part because they didn’t want to give up AI tools. In METR’s view, that likely makes the measured speedup too low (METR, Feb 24, 2026).

DORA (DevOps Research and Assessment) is a research program at Google Cloud. In its survey of nearly 5,000 professionals, 90% used AI, more than 80% felt more productive and 30% had little or no trust in AI-generated code. The report calls AI an amplifier that magnifies the strengths of high-performing organizations and the dysfunctions of struggling ones. It finds that AI now raises software delivery throughput but still increases delivery instability (DORA, 2025). In Stack Overflow’s 2025 survey, more than three in four respondents said vibe coding in the broad sense wasn’t part of their professional work (Stack Overflow, 2025 survey). In 2026, 48% trusted AI when they could easily validate the answers (Stack Overflow, 2026 survey).

So ask any provider that advertises AI speed how the time saved feeds into review. BSI and ANSSI explicitly recommend scaling up quality assurance to match.

A review of 266 sources says most comparable sources report short-term productivity gains and long-term maintenance costs, but it rates the evidence for both as weak (Siddeeq et al., Journal of Systems and Software). The numbers in parentheses refer to the list of sources.

1. Real data, logins or payments: Experts need to read and test the code and check its security, even if only a few people use the app.
2. Long-term use or important for daily work: The app needs code review and tests from the start, and someone who plans for maintenance.
3. Only for trying things out: Vibe coding is enough. Decide up front when the prototype ends, and don’t load any real data into it.

In its introduction, Microsoft advises less experienced developers to use vibe coding for experimentation and noncritical applications (Microsoft Learn, Introduction to vibe coding). In the research literature, too, prototypes come up more often than production use (Siddeeq et al.). The risk starts when a prototype quietly becomes the product. Our guide to writing a software requirements specification shows how to record your requirements afterward.

The joint recommendations from BSI and ANSSI date from September 2024 and are aimed at managers and development teams. Among other things, they call for:

• A risk analysis before adoption, covering the trustworthiness of providers and how secrets such as API keys are handled.
• Company accounts with clear contract terms instead of private logins, to avoid shadow IT. Check whether the provider uses inputs for training.
• Developers who review and understand generated code, especially for hallucinations and security vulnerabilities.
• Quality assurance that scales up, because developers can produce code faster with AI.
• Clear rules on which tools may be used with which data, plus training for everyone who uses them.

The BSI’s AI security digest for September 2026 shows how quickly the situation changes. Its entry for September 21, 2026, describes a critical flaw in several widely used coding agents: manipulated plugins could load malware. According to the digest, two vendors had already patched their agents (BSI, AI security digest 09/2026, in German).

One question to settle before you go live: who owns purely AI-generated code? In January 2025, the US Copyright Office concluded for the United States that prompts alone don’t make a user the author of the output (US Copyright Office, Jan 2025). That provides no answer for Germany or the EU. Discuss rights, liability and data protection with your legal counsel.

The numbers in parentheses refer to the list of sources. Our 12 questions for choosing a software developer cover price, team and contract. Our guide to avoiding developer lock-in covers what to agree on so you don’t depend on a single developer. Our software development page explains how we handle usage rights to code.