What Is Vibe Coding?

Vibe coding is building software by describing what you want to an AI tool and accepting the code it produces, usually without reading or reviewing that code yourself. It is a fast way to get a working prototype, but the result often lacks the security, testing and ownership a production product needs.

Reviewed by Hari Gopal Sharma, Co-Founder & CTO · Updated 2026-10-23

Where the term came from

AI researcher Andrej Karpathy, a founding member of OpenAI and former head of AI at Tesla, coined the phrase in a post on X on February 2, 2025. He described a new kind of coding where you "fully give in to the vibes" and "forget that the code even exists," talking to an AI editor, accepting its changes and pasting error messages back until things work. He framed it as fine for throwaway weekend projects. The term spread quickly, and Collins English Dictionary named it its word of the year for 2025. Today people use it loosely for almost any app built mostly by prompting tools like Lovable, Replit, Bolt or Cursor.

What vibe coding is good for

Vibe coding is useful, and it would be a mistake to dismiss it. A founder can turn an idea into something clickable in an afternoon, show it to customers and learn whether anyone cares before spending real money. Operators can build small internal tools that would never have justified a developer's time. Designers can test flows with working screens instead of static mockups. For prototypes, demos, investor conversations and personal tools that never touch customer data, the speed is the point. The trouble starts when a demo that was meant to answer a question quietly becomes the product, with real users, real payments and real data inside it.

Where vibe-coded apps break

The gaps rarely show up in a demo. They show up as data exposure, missing access controls, secrets pasted into code and no tests to catch regressions. In May 2026, Security Boulevard reported that researchers at RedAccess found about 380,000 publicly accessible apps and other assets built with tools from Lovable, Base44, Netlify and Replit, and that roughly 5,000 contained sensitive corporate information. Part of the cause was that some tools made apps public by default, and many were indexed by search engines. The vendors disputed parts of the findings, but the pattern is familiar: nobody decided who should be able to see the data, so the default decided for them.

When an AI agent has too much access

The second risk is giving an AI agent the keys to production. In April 2026, Decrypt reported that PocketOS founder Jeremy Crane said a Cursor agent running Anthropic's Claude Opus 4.6 deleted his company's production database and its volume backups in about nine seconds. The agent was working on a routine staging task, hit a credential problem and tried to fix it by deleting a storage volume through a single API call. The most recent recoverable backup was about three months old. The model was not the root problem. The agent held a token that could destroy production, and the backups lived alongside the data they were meant to protect.

Vibe coding versus AI-assisted engineering

Using AI to write code is not the same as vibe coding. Developer Simon Willison draws the line clearly: if you review the code, test it and can explain how it works, that is software development, whoever typed it. Vibe coding is when nobody reads what the AI produced. Professional teams now write a large share of their code with AI assistants, and they still review changes, run automated tests, limit what each tool can touch and keep a person responsible for every release. The tool can be identical in both cases. What differs is whether anyone owns the result once it is running in front of customers.

How we use AI coding tools at AetherCraft

We use AI coding tools every day, and they make us faster. We also believe production needs an owner. Every change is reviewed by an engineer before it merges, and automated tests run on each one. AI agents work with least privilege, so they can read and propose but cannot delete a database or push to production on their own. Secrets live in a managed store, dependencies are pinned with lockfiles, and we set up monitoring and tested backups before launch rather than after an incident. A named person is accountable for every deploy. That is how we can deliver most MVPs in 6 to 10 weeks without trading speed for risk.

Before your vibe-coded app goes live

If you built something with an AI tool and customers are about to use it, walk through a few questions first. Who can see each page and each record, and have you tested that while logged out and logged in as a different user? Where are your API keys and passwords stored, and are any of them visible in the browser or the code repository? Is the app or its database public by default on the platform you used? What happens if the database disappears tonight, and when did you last restore a backup? Which AI tools can change production, and with what permissions? Finally, who will fix it at 2am?

Frequently Asked Questions

Is vibe coding bad?

No. It is a great way to prototype, test an idea with customers or build a personal tool quickly. It becomes a problem when the prototype turns into a live product without anyone reviewing the code, locking down access, protecting secrets or planning for failures. What matters is whether someone understands the code and owns it once it is live.

Can I launch a startup on a vibe-coded app?

You can launch a test with one, especially to see whether people want the product. Before you take payments or store personal, health or financial data, have an experienced engineer review security, access controls, secrets and backups. Many founders keep the vibe-coded version as a working spec and rebuild the parts that matter properly, which is often faster than starting from a blank page.

Who coined the term vibe coding?

Andrej Karpathy, an AI researcher who helped found OpenAI and later led AI at Tesla, coined it in a post on X on February 2, 2025. He described giving in to the vibes and forgetting that the code even exists, and presented it as suited to throwaway weekend projects. Collins English Dictionary later named vibe coding its word of the year for 2025.

How do I know if my vibe-coded app is secure?

You usually cannot tell from using it, because the gaps are in what you do not see. Check whether pages and data are public by default, whether you can view another user's records by changing a link, and whether any keys are exposed in the browser. Then get a code and configuration review from an engineer who did not build it, before real customers arrive.

How is AI-assisted development different from vibe coding?

In AI-assisted development, engineers use AI tools to write code faster but still review every change, run tests, control what the tools can access and stay accountable for releases. In vibe coding, the output is accepted without review. Both can use the same tools. The difference is ownership, which is what keeps a fast build from turning into a slow and expensive cleanup later.

Related Terms

Built for Your Industry

Book a Discovery Call. Eduardo Diaz leads every AetherCraft engagement personally.