Vibe Coding
Vibe coding is a software development approach where you describe what you want in natural language and let an AI model generate the code. Instead of writing syntax line-by-line, you express intent — the vibe of what you want — and the AI translates it into working software. Your role shifts from typist to director: you describe, review, refine, and verify.
The term was coined by Andrej Karpathy (co-founder of OpenAI, former Director of AI at Tesla) in February 2025. He described it as a style where you "fully give in to the vibes, embrace exponentials, and forget that the code even exists." The concept spread so rapidly that Collins Dictionary named "vibe coding" its Word of the Year for 2025 — a first for a software development term.
| 1 | The Karpathy tweet that started it all (Feb 2025): |
| 2 | |
| 3 | "There's a new kind of coding I call 'vibe coding', where you |
| 4 | fully give in to the vibes, embrace exponentials, and forget |
| 5 | that the code even exists. (...) I ask for the dumbest things |
| 6 | like 'decrease the padding on the sidebar by half' because I'm |
| 7 | too lazy to find it. I 'Accept All' always, I don't read the |
| 8 | diffs anymore. When I get error messages I just copy paste them |
| 9 | in with no comment, usually that fixes it." |
| 10 | |
| 11 | — @karpathy, February 2, 2025 |
Since then, the term has evolved. Today it covers a spectrum — from Karpathy's original "accept all, don't read diffs" mode used for throwaway weekend projects, to a disciplined professional workflow where engineers direct AI agents through structured prompts, review every diff, and hold generated code to the same standards as hand-written code. This guide covers the full spectrum, with emphasis on the professional, production-safe end.
The Core Shift
Traditional coding — You think in a programming language. You know the syntax, the APIs, the standard library, and you translate your intent into code manually.
Vibe coding — You think in outcomes. You describe behavior, constraints, and edge cases in plain language; the AI handles syntax, boilerplate, and API recall. You spend your time on intent, architecture, and verification.
The bottleneck moves — From typing speed and API memorization to clarity of thought, prompt precision, and review rigor. The developers who thrive are the ones who can specify exactly what they want.
note
Effective vibe coding is a loop, not a single prompt. The professional workflow has five phases: describe → generate → review → refine → verify. Skipping review or verify is how vibe-coded projects end up in production incident postmortems.
| Phase | What You Do | Common Mistake |
|---|---|---|
| 1. Describe | Write a precise prompt: goal, constraints, tech stack, edge cases, what NOT to do | Vague prompts like "make it better" |
| 2. Generate | Let the AI produce the code, file structure, or diff | Interrupting mid-generation, losing context |
| 3. Review | Read every line of the diff. Understand what changed and why | "Accept All" without reading (the Karpathy mode) |
| 4. Refine | Follow-up prompts to fix issues, adjust style, handle edge cases | Rewriting by hand instead of steering the AI |
| 5. Verify | Run the code. Run the tests. Check the behavior matches the spec | Assuming it works because it compiles |
| 1 | A realistic vibe coding session (terminal + AI agent): |
| 2 | |
| 3 | $ claude "Add rate limiting to the /api/login endpoint. |
| 4 | Max 5 attempts per IP per 15 minutes. Return 429 |
| 5 | with a Retry-After header. Use the existing Redis |
| 6 | client in src/lib/redis.ts. Add tests." |
| 7 | |
| 8 | → Agent reads src/lib/redis.ts, src/app/api/login/route.ts |
| 9 | → Generates modified route.ts + new ratelimit.ts + tests |
| 10 | → Shows diff, waits for approval |
| 11 | |
| 12 | [You review the diff — it used a sliding window; you wanted |
| 13 | fixed window. You steer:] |
| 14 | |
| 15 | $ "Use a fixed window counter instead — simpler and fine for |
| 16 | this use case." |
| 17 | |
| 18 | → Agent rewrites ratelimit.ts, updates tests |
| 19 | |
| 20 | [You run the tests:] |
| 21 | |
| 22 | $ npm test -- ratelimit |
| 23 | ✓ 5 tests passing |
| 24 | |
| 25 | [Verify manually with curl, then commit.] |
pro tip
The tool landscape in 2026 splits into three camps: terminal/IDE agents for professional developers working in real codebases, AI-native editors that rebuild the IDE around the model, and app generators that turn prompts into deployed applications with minimal code exposure.
| Tool | Type | Best For | Model |
|---|---|---|---|
| Claude Code | Terminal agent | Large refactors, multi-file tasks, agentic workflows in real repos | Claude Sonnet/Opus |
| Cursor | AI-native IDE | Day-to-day editing, inline completions, chat-driven development | Multi-model (Claude, GPT, custom) |
| Codex | Cloud agent + CLI | Async task execution, PR generation, background jobs | GPT-5 family |
| GitHub Copilot | IDE extension | Autocomplete, inline suggestions, enterprise rollouts | Multi-model |
| Lovable | App generator | Full-stack web apps from prompts, non-developers, MVPs | Multi-model |
| v0 (Vercel) | UI generator | React/Next.js components, shadcn/ui interfaces from prompts | Vercel/OpenAI models |
| Bolt | Browser IDE | Instant full-stack prototypes, zero-setup demos | Multi-model |
| Replit Agent | Cloud IDE agent | Learning, quick scripts, deployable side projects | Multi-model |
For Professional Developers
Claude Code and Cursor dominate professional workflows. Claude Code excels at agentic, multi-step tasks across large codebases — it reads files, runs tests, and iterates autonomously in your terminal. Cursor wins for interactive, in-the-flow editing with its tab completions and codebase-aware chat. Many teams use both: Cursor for daily editing, Claude Code for big refactors and migrations.
For Founders and Non-Developers
Lovable, Bolt, and v0 let you describe an app and get a deployed product. Lovable generates full-stack apps (React + Supabase) from conversation. Bolt runs an entire dev environment in the browser. v0 generates production-quality React components. These tools are remarkable for validation and MVPs — but the generated code still needs a developer's eye before it handles real users and real money.
info
The difference between a vibe coding success story and a cautionary tale is process. These practices separate engineers who ship reliable AI-assisted software from those who ship hallucinated spaghetti.
The "Vibe & Verify" Standard
The industry has converged on a simple rule: you may vibe the code into existence, but you must verify it before it ships. Verification means, at minimum: the code compiles, the tests pass (and exist), you have read and understood every line of the diff, and the behavior matches the specification under realistic conditions. If you cannot explain what a generated function does, you are not done.
Spec-First Planning
Write a short spec before the first prompt: what the feature does, inputs/outputs, edge cases, constraints, and acceptance criteria. Feed it to the agent. Spec-first vibe coding produces dramatically better results than improvising prompt-by-prompt — the AI can only be as precise as your instructions.
Small, Focused Tasks
One prompt, one concern. "Add input validation to the signup form" beats "build auth." Break features into tasks the AI can complete in one context window. Large, ambiguous tasks cause drift, hallucinated APIs, and half-finished implementations.
Review Every Diff
Read AI-generated code like you would a junior developer's pull request: check logic, naming, error handling, security, and whether it matches your conventions. The "Accept All" mode from Karpathy's tweet is fine for throwaway scripts — never for production code.
Test Relentlessly
Ask the AI to write tests alongside the implementation, then run them. Generated code often looks right but has subtle off-by-one errors, wrong assumptions about data shapes, or unhandled null cases. Tests are your ground truth when you didn't write the code yourself.
Commit Early and Often
AI agents can make sweeping changes fast. Commit before every agentic session and after every verified milestone. When an agent goes off the rails (it will), git checkout . is your undo button.
Prompt quality is the single biggest lever on output quality. Compare these two prompts for the same task:
| 1 | BAD PROMPT (vague, no context, no constraints): |
| 2 | "make a function to get users" |
| 3 | |
| 4 | → The AI guesses: which database? what fields? pagination? |
| 5 | auth? error handling? You get generic code you'll rewrite. |
| 6 | |
| 7 | ──────────────────────────────────────────────────────────── |
| 8 | |
| 9 | GOOD PROMPT (specific, contextual, constrained): |
| 10 | "Write a TypeScript function getActiveUsers in |
| 11 | src/db/users.ts that: |
| 12 | - Queries the Postgres 'users' table using the existing |
| 13 | drizzle client from src/db/client.ts |
| 14 | - Returns users where status = 'active' AND |
| 15 | last_login_at > NOW() - INTERVAL '30 days' |
| 16 | - Supports cursor pagination (cursor param, limit param, |
| 17 | default 20, max 100) |
| 18 | - Returns { users: User[], nextCursor: string | null } |
| 19 | - Throws a typed DatabaseError on query failure |
| 20 | - Include a JSDoc comment and one usage example |
| 21 | Do NOT add new dependencies." |
| 22 | |
| 23 | → The AI has everything it needs. First-pass output is |
| 24 | usually 90%+ correct and matches your codebase style. |
best practice
Vibe coding excels where the problem is well-understood, the patterns are common, and the cost of iteration is low. In these scenarios it delivers 5–10x speedups with acceptable risk.
| Scenario | Why It Works | Speedup |
|---|---|---|
| Prototyping | Speed matters more than polish; throwaway code is expected | 10x — hours not days |
| MVPs | Validate the idea first; rewrite later if it works | 5–10x — weeks not months |
| Boilerplate | CRUD routes, forms, schemas — patterns the AI knows cold | 10x+ — near-instant |
| CRUD apps | Well-trodden territory with mature frameworks | 5x — full stack in a day |
| Tests & docs | AI is excellent at generating test cases and docstrings | 3–5x |
| Learning | Explore new languages/frameworks with an expert pair | 2–3x faster ramp-up |
| Migrations | Mechanical transforms (class→hooks, JS→TS, v1→v2 APIs) | 5x on large codebases |
| 1 | // Prompt: "Generate a Zod schema and validation middleware |
| 2 | // for a signup endpoint: email, password (min 12 chars, 1 |
| 3 | // uppercase, 1 number), name (2-50 chars), optional referral |
| 4 | // code (8-char alphanumeric)." |
| 5 | |
| 6 | import { z } from "zod"; |
| 7 | import type { Request, Response, NextFunction } from "express"; |
| 8 | |
| 9 | export const signupSchema = z.object({ |
| 10 | email: z.string().email("Invalid email address"), |
| 11 | password: z |
| 12 | .string() |
| 13 | .min(12, "Password must be at least 12 characters") |
| 14 | .regex(/[A-Z]/, "Must contain an uppercase letter") |
| 15 | .regex(/[0-9]/, "Must contain a number"), |
| 16 | name: z.string().min(2).max(50), |
| 17 | referralCode: z |
| 18 | .string() |
| 19 | .regex(/^[A-Z0-9]{8}$/, "Invalid referral code") |
| 20 | .optional(), |
| 21 | }); |
| 22 | |
| 23 | export type SignupInput = z.infer<typeof signupSchema>; |
| 24 | |
| 25 | export function validateSignup( |
| 26 | req: Request, |
| 27 | res: Response, |
| 28 | next: NextFunction |
| 29 | ) { |
| 30 | const result = signupSchema.safeParse(req.body); |
| 31 | if (!result.success) { |
| 32 | return res.status(400).json({ |
| 33 | errors: result.error.flatten().fieldErrors, |
| 34 | }); |
| 35 | } |
| 36 | req.body = result.data; |
| 37 | next(); |
| 38 | } |
| 39 | |
| 40 | // This kind of boilerplate — schema, types, middleware — |
| 41 | // is where vibe coding shines brightest. Review, test, ship. |
info
Vibe coding has real limits. Knowing where the approach breaks down is as important as knowing where it shines. In these areas, use AI as an assistant for isolated pieces — never as the primary author.
Complex Business Logic
Pricing engines with 47 rules, insurance underwriting, tax calculations — logic where correctness depends on deep domain context the AI doesn't have. It will produce something that looks plausible and is subtly, expensively wrong. Write this yourself; use AI for the surrounding scaffolding.
Security-Critical Code
Authentication, authorization, cryptography, payment flows. Models reproduce common patterns — including common vulnerabilities. Generated auth code has shipped with timing attacks, broken session invalidation, and hardcoded secrets. Security code demands expert authorship and expert review.
Performance Optimization
AI optimizes for plausible-looking code, not measured performance. It cannot profile your hot path, doesn't know your data volumes, and often generates O(n²) algorithms where O(n) exists. Optimization requires measurement — benchmark first, then decide if AI suggestions actually help.
Legacy Integration
Undocumented COBOL interfaces, quirky internal APIs, frameworks that predate the training data. The AI hallucinates APIs that don't exist and misunderstands conventions it has never seen. Legacy work requires human archaeology first — document the system, then vibe on top of the docs.
Novel Algorithms & Research Code
If the problem is genuinely new, there is no pattern in the training data to reproduce. The model will confidently produce a plausible-but-wrong hybrid of related algorithms. Novel work stays human-led.
warning
Perhaps the most disruptive aspect of vibe coding is who it enables. Founders, designers, product managers, and domain experts can now build functional software by describing it. This is a genuine democratization of software creation — with important caveats about the last 20%.
The Non-Developer Toolkit
Lovable / Bolt / Replit Agent — Describe an app in conversation; get a deployed, working product with a database. Best for validating ideas and internal tools.
v0 by Vercel — Describe a UI; get production-quality React components. Best for designers who want real code instead of mockups.
ChatGPT / Claude web — Paste errors, ask for fixes, iterate conversationally. Best for scripts, automations, and learning.
No-code adjacents — Tools like Zapier with AI steps, Airtable AI, and Notion AI blur the line between no-code and vibe coding entirely.
| 1 | Prompt engineering for app generation (Lovable/Bolt style): |
| 2 | |
| 3 | LEVEL 1 — The vision prompt: |
| 4 | "Build a booking app for dog groomers. Groomers set their |
| 5 | availability; dog owners browse groomers, book slots, and |
| 6 | pay a deposit. Include email confirmations." |
| 7 | |
| 8 | LEVEL 2 — After the first generation, refine with specifics: |
| 9 | "The booking calendar should show a week view. Blocked slots |
| 10 | are gray, booked slots are green, available are white. |
| 11 | Clicking an available slot opens a booking form." |
| 12 | |
| 13 | LEVEL 3 — Fix issues by describing symptoms, not code: |
| 14 | "When I book a slot and refresh the page, the slot shows as |
| 15 | available again. The booking isn't persisting." |
| 16 | |
| 17 | LEVEL 4 — Know when to hand off: |
| 18 | "Export the codebase" → give it to a developer for auth |
| 19 | hardening, payment edge cases, and production deployment. |
| 20 | |
| 21 | The skill is the same as working with a human contractor: |
| 22 | clear requirements, specific feedback, realistic scope. |
note
AI-generated code carries specific, well-documented risks. Studies in 2025 consistently found that 30–45% of AI-generated code snippets contained security weaknesses when prompts didn't explicitly request secure implementations. The risks are manageable — but only if you know what to look for.
Hallucinated Dependencies
AI models invent package names that sound right but don't exist. Attackers exploit this with "slopsquatting" — publishing malicious packages under commonly hallucinated names. Verify every new dependency exists, is the official package, and has a healthy download history before installing.
Outdated & Vulnerable Patterns
Training data contains years of Stack Overflow answers — including the insecure ones. Generated code may use MD5 for hashing, string concatenation for SQL, or deprecated APIs with known CVEs. Always run dependency scanners (npm audit, pip-audit) and SAST tools on generated code.
Secrets in Code
Models happily hardcode API keys, passwords, and connection strings — they learned from examples that did. Scan for secrets before every commit (gitleaks, trufflehog). Never let generated auth code reach production without manual review.
Missing Validation & Error Handling
AI generates the happy path by default. Input validation, boundary checks, and error handling appear only when you explicitly ask. Make "include input validation and error handling" a standard line in your prompts.
| 1 | Vibe Coding Security Review Checklist: |
| 2 | |
| 3 | DEPENDENCIES |
| 4 | □ Every package exists and is the official one (check the |
| 5 | registry directly, not just the AI's word) |
| 6 | □ npm audit / pip-audit / cargo audit is clean |
| 7 | □ No new dependency without a reason |
| 8 | |
| 9 | SECRETS & CONFIG |
| 10 | □ No hardcoded keys, tokens, passwords, or URLs |
| 11 | □ All secrets come from environment variables |
| 12 | □ .env files are gitignored |
| 13 | |
| 14 | INPUT & OUTPUT |
| 15 | □ All user input is validated (schema, not regex-by-hand) |
| 16 | □ SQL uses parameterized queries, never string concat |
| 17 | □ Output is escaped/sanitized for its context (HTML, SQL, |
| 18 | shell) |
| 19 | |
| 20 | AUTH & ACCESS |
| 21 | □ Auth checks exist on every protected route (not just UI) |
| 22 | □ Session handling uses the framework's built-ins |
| 23 | □ Crypto uses standard libraries (never hand-rolled) |
| 24 | |
| 25 | BEHAVIOR |
| 26 | □ Tests pass, including the error cases |
| 27 | □ Error handling covers timeouts, nulls, and failures |
| 28 | □ You have read and understood every line of the diff |
warning
Vibe coding in 2026 is already past its chaotic honeymoon phase. The field is professionalizing fast, and three trends define where it's heading.
Where the Field Is Heading
Agentic development — Single-shot prompt→code is giving way to autonomous agents that plan, write, run, test, and iterate over hours. Tools like Claude Code, Codex, and Devin-class agents handle entire tickets. The developer's job becomes task decomposition, review, and course correction — closer to engineering management than typing.
Multi-agent orchestration — Specialized agents working in concert: one writes code, one reviews it, one writes tests, one checks security, one updates docs. Orchestrators route work between them. Early versions exist today; expect this to be standard practice by 2027.
Spec-driven development — The industry is rediscovering that precise specifications are the highest-leverage artifact. New workflows center on machine-readable specs (OpenAPI, JSON Schema, formal behavior specs) that agents implement against, with automated conformance checking. The spec becomes the source of truth; the code becomes a derived artifact.
Verification automation — As generation gets faster, verification becomes the bottleneck. Expect formal verification, property-based testing, and AI-reviewing-AI (with independent models checking each other) to become standard parts of the pipeline.
| Era | Developer's Role | Key Skill |
|---|---|---|
| 2023 — Autocomplete | Typist with a fast assistant | Accepting good suggestions |
| 2025 — Vibe coding | Director of a code generator | Prompt precision, diff review |
| 2026 — Agentic | Manager of AI agents | Task decomposition, verification |
| 2027+ — Spec-driven | Architect of specifications | System design, formal specs |
The constant through all of this: the engineer's responsibility doesn't shrink — it shifts. You remain accountable for what ships. The tools change; the judgment, system design skill, and verification discipline that define great engineers become more valuable, not less. Learn the fundamentals. The vibes are only as good as the engineer steering them.
pro tip
Community
Get help on Slack, Discord or VIP
Stuck on a guide? Join the community and ask.