Vibe coding · 8 min read

What is vibe coding?

You describe what you want in plain English; an AI writes the code. That's the whole idea — and in a year it went from a single tweet to how a lot of software now gets built. Here's what it actually means, where it works, and how to do it without shipping a security hole.

VThe Vertos teamUpdated July 2026

Vibe coding is building software by telling an AI what you want in ordinary language and letting it write and change the code — with little or no line-by-line coding from you. Instead of authoring every function, you steer: describe the feature, look at what the AI produces, run it, and say what to fix next. The term is barely a year old, but the idea has quietly rewired how prototypes, side projects, and even production apps get made.

The originWhere the term came from

"Vibe coding" was coined by Andrej Karpathy — a co-founder of OpenAI and former head of AI at Tesla — in a February 2025 post. He described a new way of building where you "fully give in to the vibes" and "forget that the code even exists," possible because the AI models had finally gotten good enough to drive from natural-language prompts. The name stuck because it captured the feeling exactly: less typing, more directing.

"There's a new kind of coding I call vibe coding, where you fully give in to the vibes, embrace exponentials, and forget that the code even exists."

— Andrej Karpathy, February 2025

How it worksThe describe-generate-test-refine loop

Vibe coding isn't one prompt and done. It's a short, fast loop you run over and over until the thing works:

1DescribeTell the AI what you want in plain language — "a page where users upload a CSV and see a chart of the totals."
2GenerateThe AI writes the code — files, functions, UI, and all — and often runs it for you.
3TestYou try it. Something's off, or an error pops up, or it's 90% right.
4RefineYou give the next instruction — "good, now add error handling for a missing file" — and the loop repeats.

…repeat until it works. The skill isn't syntax anymore — it's describing intent clearly.

The honest pictureWhere it shines, where it strains

✓ Shines
  • Prototypes and MVPs — an idea to a working app in an afternoon
  • Non-developers building real, useful tools
  • Boilerplate, UI scaffolding, and glue code
  • Learning by doing — you see working code fast
  • Getting unstuck when you know what, not how
△ Strains
  • Large, complex codebases with lots of hidden context
  • Security-sensitive or regulated systems
  • Anything where you can't review what was written
  • Debugging problems the AI itself introduced
  • Long-term maintainability if no one understands the code

The catchThe security reality

Here's the part the hype skips. AI writes plausible code fast — and plausible isn't the same as safe. Research in 2026 found AI-generated code carries materially more security flaws than human-written code, and when researchers scanned thousands of live vibe-coded apps, the results were sobering:

2,000+ vulnerabilities and 400+ exposed secrets were found in a single scan of ~5,600 publicly deployed vibe-coded apps. The tools didn't fail — people shipped the output without reading it. The classic pattern: AI writes a database query that drops user input straight in, it works fine in testing, and it's wide open to SQL injection in production.

The mental model that keeps you safe: treat your AI like a brilliant but inexperienced junior developer. It produces code at an incredible rate, but it doesn't understand your architecture, your threat model, or what "secure" means for your app. Every line still needs a real review.

Do it rightVibe coding without the footguns

✦ The safe-vibe checklist
✓Review every diff. Treat AI output as an untrusted first draft, not finished code — read it before you accept it.
✓Never put secrets in prompts. No API keys, passwords, or real customer data in the chat — and check none got hard-coded into the output.
✓Ask for security in the prompt. Say "use parameterized queries," "validate and sanitize input," "don't log secrets" — it listens when you ask.
✓Test and scan before shipping. Run it, write a few tests, and put it through a static-analysis and dependency scan.
✓Keep a human in the loop for anything real. Prototypes can be loose; anything touching money, auth, or personal data needs a careful eye.
Not sure which tool to vibe-code with? We broke down the whole field — Cursor, Windsurf, Claude Code, Copilot, Bolt, Lovable, and v0 — by what each is actually best at: the best vibe coding tools in 2026.

The bridgeFrom vibe-coded to valuable

Here's the part builders miss: a vibe-coded app with real users is a real asset. The barrier to starting software just collapsed, which means more projects exist — and more of them get abandoned. If yours found some traction, it can be worth selling; buyers just look closely at the code (which is exactly why clean, reviewed code is worth more). And if you're on the buying side, a vibe-coded app can be a bargain — as long as you read the code before you commit.

Vibe-coded something with traction?

List it on Vertos free — a built-in AI Analysis shows buyers exactly what's in the code, so a well-built app earns its price. Or buy one that's already made and skip the blank page.

Browse projects →

Give in to the vibes — carefully.
— The Vertos team

Sources & notes

Definition and history per MIT Technology Review and Google Cloud; the origin is Andrej Karpathy's February 2025 post. Security figures from IBM and TechTarget; best practices draw on the Cloud Security Alliance guide. General education, not security advice for a specific system.