What Is Vibe Coding? A Practical Definition for 2026

Vibe coding is building software by telling an AI what you want in plain English, running what it produces, and steering with feedback instead of writing or closely reading the code yourself. Andrej Karpathy coined the term in early 2025. Today people use it for everything from a weekend toy to an app with real users. The most useful way to define it is by how much of the code you actually look at.

Where the term came from

In February 2025, Karpathy posted on X about a style of coding where you "fully give in to the vibes" and forget the code exists. He described accepting every change without reading diffs and pasting error messages back in with no comment. He also called it "not too bad for throwaway weekend projects."

That last part gets lost. The original meaning was narrow: a low-stakes, trust-the-AI way of messing around. The word has since stretched to cover any AI-assisted building, which is why definitions online don't quite agree.

A working definition for 2026

Here's the version I'd use. You're vibe coding when:

• You describe outcomes in natural language, not implementations.
• The AI writes most or all of the code.
• You judge the result by running it, not by reviewing every line.
• You iterate by prompting, pasting errors and asking for changes.

If you're reading and understanding every diff, you're doing AI-assisted programming, which is a fine thing but a different one. The line is blurry, and it's more of a dial than a switch.

The dial, from loose to strict

That last label is Karpathy's own update. A year after his original post, The New Stack reported that he now frames professional work with coding agents as "agentic engineering," with more oversight and scrutiny than the original vibe coding implied. The tools overlap. The difference is how much responsibility you keep.

The tools people use

They fall into two rough groups:

• Editors and agents such as Cursor, Windsurf and Claude Code. They work inside a real codebase on your machine. You get more control, and you'll see more code.
• App builders such as Lovable, Bolt, v0 and Replit. You prompt in the browser and get a running app, often with hosting included. They're easier to start with and hide more of the machinery.

Features and pricing in this category change often. Check each tool's own pricing page before you pick one, and don't trust any comparison table, including ones in old blog posts.

How to try it in an afternoon

1. Pick something small and yours. A habit tracker, a script that renames files, a landing page. Avoid anything touching payments or other people's data for your first run.
2. Write the goal in a paragraph. Say who it's for, what it does and what "done" looks like.
3. Ask for a plan first. Have the AI list the steps and the files before it writes anything. Correct the plan, not the code.
4. Build one slice at a time. Get one screen or one feature working, then move on. Big first prompts produce big messes.
5. Run it after every change. When something breaks, paste the full error message and say what you expected.
6. Save your progress. Use Git or your tool's version history so you can roll back when the AI wanders off.

A starter prompt you can paste

I want to build [one-sentence description] for [who will use it].

Rules:
- Keep it as simple as possible. No extra features.
- Before writing code, give me a short plan: the files you'll create and what each does.
- Wait for me to say "go" before building.
- Build in small steps and tell me how to run and test each one.
- Never hardcode API keys or passwords. Use environment variables.
- If something is ambiguous, ask me instead of guessing.

Definition of done: [what you should be able to do when it works].

The "wait for me to say go" line is the useful one. It gives you a checkpoint before the AI commits to a direction.

A concrete example

Say you want a tool that turns a pasted list of tasks into a printable daily plan. A vibe-coding session might go like this:

• You describe the tool and ask for a plan. The AI proposes a single page with a text box and a print button.
• You say go. It builds the page. You open it and paste in five tasks.
• The print layout is ugly, so you say "make it fit on one page, bigger checkboxes." You never open the CSS.
• It breaks when you paste an empty line. You paste the error back in. It's fixed.

That's the whole loop: describe, run, react. It works well when the stakes are low and the feedback is instant, because you can see right away whether it's correct.

Where vibe coding goes wrong

The trouble starts when "it runs" gets mistaken for "it's safe." AI-written code often works fine on the happy path while hiding problems you can't see by clicking around: exposed keys, missing access checks, and packages that don't exist.

The evidence is mixed in its details but consistent in direction. Georgia Tech researchers built a Vibe Security Radar that tracks vulnerabilities traced back to AI-generated code. It had confirmed 74 cases when they wrote it up, 14 of them critical. The researcher's point was that AI models repeat the same mistakes, so one pattern found in one codebase can be searched for across thousands.

A separate test by security firm Tenzai, summarized by Hashnode, had five popular tools build 15 identical apps. It found 69 vulnerabilities, six of them critical. I'd treat the exact numbers as snapshots, since tools and models keep changing. The takeaway holds anyway: don't assume the AI handled security for you.

A pre-launch checklist

Before anyone else uses your app, do these:

• Search for secrets. Make sure no API keys or passwords are in the code or the repo. Rotate any that were.
• Test who can see what. Log in as one user and try to reach another user's data.
• Check the dependencies. Confirm every package is real, maintained and one you meant to install.
• Ask the AI to review itself. Prompt it to audit the code for security problems, then verify the important claims yourself.
• Run a scanner. Free or built-in security scanners catch the obvious stuff.
• Back up your data. And find out how to roll back a bad deploy.

If the app handles payments, health data or anything legally sensitive, get a human who knows security to look at it. That's not a vibe-coding failure. It's just the cost of shipping something that matters.

When it's a good fit

• Good: prototypes, personal tools, internal dashboards, landing pages, learning projects, throwaway scripts.
• Be careful: anything with user accounts, uploaded files or public traffic.
• Don't, unless you have expert review: payments, medical or legal data, safety-critical systems.

A habit that helps: when you're about to hit accept on something you don't understand, ask the AI to explain it in plain language first. You'll learn faster, and you'll catch more of the weird stuff.

FAQ

Is vibe coding the same as using an AI coding assistant?

Not quite. An assistant that autocompletes lines while you write code is AI-assisted programming. Vibe coding means the AI does most of the writing and you steer by describing, running and correcting, usually without reading every line. In practice the two blur together, so ask how much of the code you're reviewing.

Do I need to know how to code to vibe code?

You can start without it, and app builders are designed for that. But some basics go a long way: knowing what a file, an API key and a database are, plus how to read an error message. The more your app matters, the more you'll want to understand what the AI built, or have someone check it.

Is vibe coding still a thing in 2026?

Yes, though the word has split. Casual, trust-the-AI building is still called vibe coding. Professional work with coding agents is increasingly called agentic engineering, which Karpathy himself has pushed. The tools are the same. What's changed is how much oversight people expect around them.

Cover photo: Swello on Unsplash