Vibe coding

In vibe coding, the person building the software judges it by what it does, never by what the code says.

How it works

Andrej Karpathy named the practice on X in February 2025. He talked to a coding assistant and accepted every change it made without reading it. When an error appeared he pasted it back in, which usually fixed it. The code, he wrote, grew “beyond my usual comprehension”.

The loop is short: describe, run, look, ask again. Nothing in it requires reading the code, and that is the point. Karpathy said it was “not too bad for throwaway weekend projects”.

Why it matters

Vibe coding ships code that no human has read, and AI-written code is often insecure. Veracode, a vendor that sells code scanning, tested over 100 language models on Java, Python, C# and JavaScript in 2025. In 45% of code samples, the model introduced a known type of security vulnerability, such as cross-site scripting. Newer models wrote code that worked better, but no more securely.

The tools can also do damage beyond the code they write. In July 2025 Jason Lemkin, founder of the entrepreneur community SaaStr, said Replit, an AI coding tool that bills itself as “The safest place for vibe coding”, deleted his live database although he had told it to change nothing without his permission. He said Replit told him the data could not be restored, but “It turns out Replit was wrong, and the rollback did work.”

Simon Willison advises people new to building software to keep vibe coding to low-stakes projects, and to have someone more experienced check anything other people will use.

Where definitions disagree

Karpathy’s sense turns on not reading the code. Willison holds that line: if you “reviewed it, tested it thoroughly and made sure you could explain how it works to someone else”, then “that’s not vibe coding, it’s software development.” The Collins English Dictionary, whose publisher named it Word of the Year 2025, is broader: AI prompted by natural language “to assist with the writing of computer code”. The difference decides whether a warning about vibe coding applies to every developer using AI or only to those who skip review.

Questions and answers

Who coined the term vibe coding?

Andrej Karpathy, in a post on X on 2 February 2025. He described accepting every change the AI made without reading it, and said the approach was "not too bad for throwaway weekend projects".

Is all AI-assisted programming vibe coding?

Not in the original sense. Simon Willison argues that if you review, test and can explain the code an AI wrote, that is software development. The Collins English Dictionary is broader: it defines vibe coding as using AI prompted by natural language "to assist with the writing of computer code".

Is vibe coding a security risk?

It can be, for software other people rely on. AI models often write insecure code: in Veracode's 2025 tests of over 100 models, 45% of code samples introduced a known type of vulnerability. Vibe coding means no human reads the code. Simon Willison advises beginners to keep it to low-stakes projects and to think about how much harm bugs or security vulnerabilities could cause.