What does vibe coding mean?
You do not type the code. You tell a model what you need (“a Telegram bot that forwards leads to a spreadsheet”), run what it gives you and ask for fixes. When something breaks, you paste the error back into the chat. Nobody reads the diff.
Collins defines vibe coding as using AI, prompted by natural language, to write code. It was announced as Word of the Year 2025 on 6 November 2025, ahead of aura farming and clanker on the shortlist.
Karpathy framed it as a half-joking mode for throwaway weekend projects. The word outgrew that. Today it covers everything from a prototype built in an evening to production code that no one on the team has read end to end.
Who is actually vibe coding?
Y Combinator gave the most quoted number. In March 2025 managing partner Jared Friedman said that about a quarter of the W25 batch had codebases that were 95 % AI-generated. That is founders reporting on themselves, not an audit, and Friedman stressed these founders were technical.
A Russian survey by Bitrix24 (October 2026, sample size not disclosed) shows who does it outside the startup bubble: 44 % of active vibe coders are business owners and only 19 % are developers. 62 % vibe code almost daily, and 27 % started with no programming background at all.
What tools do people use for vibe coding?
The useful split is where the agent lives.
Runs inExamplesGood forTerminalClaude Code, Codex, Gemini CLI, OpenCode, AiderPeople who want the agent to run tests, git and scripts on its ownCode editorCursor, GitHub Copilot in VS Code, Windsurf (now Devin Desktop), Zed, KiroPeople who want to see every edit in a familiar windowBrowserReplit, Lovable, Google AI Studio BuildFirst prototypes with nothing to installOur take: a browser builder is fine for a first project. Once the thing lives longer than a week, move to a terminal agent or an editor with git. That is the only place where you can roll back when the model confidently breaks what worked yesterday.
Agents are configured with files: project rules (AGENTS.md and CLAUDE.md), skills, MCP servers and hooks. The formats table shows which platform reads which file.
Is vibe coding safe? The numbers that hold up
Plenty of statistics float around. These are the ones we traced to the original source.
- Veracode, 2025. 80 coding tasks across more than 100 LLMs. In 45 % of tasks the generated code contained an OWASP Top 10 vulnerability.
- NYU, 2021. A study of GitHub Copilot output: 89 scenarios, 1,692 programs. The press release says about 40 % were vulnerable; the paper itself counts 477 of 1,084 valid programs, which is 44 %. It predates the term vibe coding.
- Wiz, September 2025. About one in five organizations shipping vibe-coded apps had serious risks. In July 2025 Wiz also found an authentication bypass in the Base44 platform.
The agent itself is a second risk. In July 2025 a Replit agent deleted Jason Lemkin's production database. Claude Code had CVE-2025-55284: before version 1.0.4 an overly broad allowlist of “safe” commands let a prompt injection read a file and send it over the network. It was fixed through auto-update.
How to vibe code without losing the project
- Use git from day one. Commit before every big request, so a rollback is one command.
- Keep keys out of client code. A leaked key on a landing page burns money faster than any bug.
- Enforce bans with a hook, not a polite line in CLAUDE.md. Claude Code docs say plainly that CLAUDE.md is context, not enforced configuration.
- Separate dev and prod. The agent does not need the live database to fix a button.
- Ask for tests before the agent starts fixing things. Otherwise it fixes one feature and breaks two others.
Rules and skills for security review are collected in our security picks.
