What is vibe coding? Definition, origin, and honest limits

Vibe coding is building software by describing what you want to an AI in natural language and accepting the code it produces — mostly or entirely without reading it. You say what the app should do; the model writes the files; you judge the result by clicking through it, not by reviewing the diff.

That's the short version. The long version involves a dictionary award, a security-report record, and one of the fastest semantic drifts a tech term has ever had.

Where the term comes from

Andrej Karpathy coined "vibe coding" in a post on X on February 2, 2025:

"There's a new kind of coding I call 'vibe coding', where you fully give in to the vibes, embrace exponentials, and forget that the code even exists."

Two details of the original post usually get dropped when it's quoted. First, Karpathy scoped it explicitly: he called it fine for "throwaway weekend projects" — not production. Second, he described the method with total honesty: always click Accept All, don't read the diffs, paste error messages back into the model and let it try again.

The term escaped its origin fast. Merriam-Webster listed "vibe coding" as slang and trending by March 2025. Nine months after the tweet, in November 2025, Collins English Dictionary named it Word of the Year, defining it as software development that turns natural language into computer code using AI.

The strict definition vs. the one people actually use

Simon Willison drew the sharpest line in March 2025: vibe coding is "building software with an LLM without reviewing the code it writes." If you read, test, and understand what the AI wrote, you're not vibe coding — you're doing AI-assisted programming. The whole distinction is whether a human ever reviews the output.

In everyday 2026 usage, though, the term has broadened. It now covers prompt-driven app building in general: a human directs in natural language, an agent writes and often deploys the code, and most of that code is never read. Keyhole Software's June 2026 definition captures the mainstream sense — "prompt-driven, minimally governed use of AI coding tools, where code is generated and often deployed with limited architectural planning or review."

The drift didn't stop there. Willison himself proposed "vibe engineering" in October 2025 for the accountable, production-grade version of agent-assisted work, noting that "vibe coding" had become a term many developers use dismissively. By early 2026, "agentic engineering" had emerged as the preferred label for the disciplined practice — leaving "vibe coding" to mean the casual, unreviewed mode. So when someone asks whether they should vibe code, they're really asking where on that spectrum they want to stand.

The money followed the words. The tools most associated with the practice — Cursor, GitHub Copilot, Claude Code, Replit's agent, Lovable, Bolt.new, v0, and the app-builder platforms — became a defining category of 2025-2026: CNBC reported Cursor's maker raising at a $29.3 billion valuation in November 2025, and JetBrains' 2025 developer survey of roughly 24,500 developers found 85% regularly using AI coding tools. Whatever one thinks of the label, the practice it names went mainstream.

Vibe coding is not no-code

The two get conflated because both promise "apps without programming." They're different bets.

No-code tools give you visual blocks — forms, tables, workflows — and your app is a configuration that lives inside the platform. You never hit a syntax error, and you never own a codebase either. Vibe coding generates actual code, which means the ceiling is much higher: anything expressible in code is in scope.

But there's a catch worth testing on any platform: do you actually get the code? On some builders the generated code stays behind glass — you interact only through prompts, and the hosting, database and auth are proprietary. That's functionally no-code with a chat interface. On others you get a real repository you can export and run anywhere. Our comparison hub tracks exactly this across the major tools.

When vibe coding works

The evidence for the upside is real. TechCrunch reported in March 2025 that a quarter of Y Combinator's Winter 2025 batch had codebases that were roughly 95% AI-generated — venture-backed startups, not weekend toys. The practice demonstrably works for:

1. Validation and prototypes. Testing whether anyone wants the thing before investing an engineer-month in it.
2. Internal tools. A CRM view, a booking dashboard, a calculator — small blast radius, huge time savings.
3. Karpathy's original scope. Throwaway weekend projects, where the code genuinely doesn't need to outlive the weekend.
4. Real products — with gates. Paired with automated checks and a human review before launch, prompt-first building is just a faster way to write software you then treat seriously.

The criticism, taken seriously

The backlash of 2025-2026 is not hand-waving; it's documented, and a definition post that skips it isn't defining the real thing.

Security. Veracode's GenAI Code Security Report (2025) tested over 100 models on 80 curated tasks and found AI-generated code introduced OWASP Top 10 vulnerabilities in 45% of cases; its Spring 2026 update reported the secure-code rate still stuck around 55% — newer models write more functional, not more secure, code.

Real incidents. In May 2025, a security review covered by Semafor found 170 of 1,645 sampled apps built with Lovable exposed personal data through misconfigured access rules. In July 2025, Fortune reported that Replit's agent deleted a company's production database during an explicit code freeze — Replit's CEO called it unacceptable and shipped guardrails.

Speed. METR's randomized controlled trial (July 2025) found 16 experienced open-source developers took 19% longer on real issues when using early-2025 AI tools — while estimating they'd been about 24% faster. The perception gap is the finding.

Trust. Stack Overflow's 2025 survey of roughly 49,000 developers found 84% using or planning to use AI tools, but 46% actively distrusting the accuracy of their output. Adoption is real; so is the wariness.

One hygiene note, since stat pages recycle it endlessly: the "92% of developers use AI" figure comes from a 2023 GitHub/Wakefield survey of 500 U.S. enterprise developers. It is not a 2026 number, whatever the listicle says.

We've steelmanned the full case — and what it takes to answer it — in Is vibe coding bad?

Where opix fits

opix is a vibe-coding platform built around exactly those documented failure modes. Every generation passes a type-check and a runtime smoke test before you see it, and repairs are automatic. The output is real, exportable Next.js on a dedicated Postgres database — code you own, not a black box. And the billing answers the other chronic complaint: a live cost meter, and failed builds cost $0.

The honest limit: gates catch what doesn't compile and what crashes. They don't replace a human look at your authorization rules before you handle real user data — nothing does yet. What a well-designed platform removes is the unchosen debt: the broken build you paid for, the code you can't leave with, the vulnerability that shipped silently.

Vibe coding, in 2026, is neither a joke nor a scandal. It's a genuinely new way to make software that works brilliantly inside its limits — and the platforms worth using are the ones honest about where those limits are. Try a build free and read the meter yourself.