# What is vibe coding? Origin, tools and risks explained

> Andrej Karpathy coined the term in February 2025 for letting AI write code you never read. Here is how it differs from AI-assisted engineering, and what studies say about the risks.

URL: https://claudegpt.si/news/what-is-vibe-coding  
Published: 2026-11-07T22:53:27.491Z  
Author: ClaudeGPT Si Newsroom  
Section: Research  
Topics: Vibe coding, Andrej Karpathy, Cursor, Claude Code, Lovable, Replit  
Publisher: ClaudeGPT Si

## Key takeaways

- Andrej Karpathy coined 'vibe coding' in an X post on February 2, 2025, describing accepting all AI changes and not reading the diffs.
- The usual dividing line from AI-assisted engineering is review: Simon Willison defines vibe coding as building software with an LLM without reviewing the code.
- In the SusVibes benchmark, one agent setup produced working code 57% of the time but secure code only 11.8% of the time.

Vibe coding is building software by describing what you want to an AI model and accepting what it writes without reading the code. Andrej Karpathy coined the term in a post on X on February 2, 2025, and it has since stretched to cover almost any programming done with AI. The strict meaning is narrower, and the difference matters once real users are involved.

## Where the term comes from

Karpathy's [post](https://x.com/karpathy/status/1886192184808149383) began: "There's a new kind of coding I call 'vibe coding', where you fully give in to the vibes, embrace exponentials, and forget that the code even exists." He described his own workflow with Cursor's Composer feature running Claude Sonnet, talking to it by voice. He said he always clicks "Accept All" and no longer reads the diffs. When an error appears, he pastes it back in with no comment.

He was also clear about the limits. He called it "not too bad for throwaway weekend projects" and admitted the code grew "beyond my usual comprehension." So the original meaning has two parts: you let the AI write the code, and you stop reviewing it. Without the second part, it is just coding with a tool.

## How it differs from AI-assisted engineering

The line most developers draw is review. Programmer Simon Willison [put it](https://simonwillison.net/2025/Mar/19/vibe-coding/) this way: vibe coding is "building software with an LLM without reviewing the code it writes." He adds that it is not the same as writing code with the help of LLMs. If you read, test and understand what the model produced, he says, that is ordinary software development, and the model's part in it doesn't change that.

| | Vibe coding | AI-assisted engineering |
| --- | --- | --- |
| Who reads the code | Nobody, or only the error messages | The developer, line by line or through tests |
| How problems are fixed | Paste the error back, ask again | Find the cause, then decide on the fix |
| Typical use | Prototypes, personal tools, weekend projects | Code that ships to users and has to be maintained |
| Who is accountable | Unclear | The developer who committed it |

In practice the two blur. Many people vibe code the first version and then start reading once it works. The term has also drifted: a research paper on the subject, discussed below, defines it more loosely as developers describing desired functionality in natural language while the AI produces the source code.

## Tools people use for it

Four tools come up most often. The descriptions below are the companies' own.

- **Cursor.** An editor built around AI agents. Cursor says it is "your coding agent for building ambitious software." It is the tool Karpathy named in his post. See our [Cursor vs Claude Code comparison](https://claudegpt.si/news/cursor-vs-claude-code-comparison) and our article on [building live apps in Cursor](https://claudegpt.si/news/cursor-build-live-apps).
- **Claude Code.** Anthropic's coding agent. Its product page says it runs in your terminal, and it also has VS Code and JetBrains extensions, a desktop app, a web version and mobile apps. Costs are covered in our [Claude Code pricing guide](https://claudegpt.si/news/claude-code-pricing-plans-api-cost).
- **Lovable.** Describes itself as "a full-stack AI development platform for building, iterating on, and deploying web applications." You describe an app in plain language and it generates the frontend, backend, database and sign-in. The code can sync to GitHub.
- **Replit.** Its Agent is pitched as "Describe and publish your project," with hosting, a database and authentication included, and no coding required.

Cursor and Claude Code are built for people who can read code, which makes both usable for either style. Lovable and Replit aim at people who may never open the code, so vibe coding is closer to their default.

## What the research says about the risks

Evidence is still thin and mostly preprints, so treat the numbers as signals. Three studies are worth reading.

**Security.** A benchmark called SusVibes, from Zhao and colleagues ([arXiv 2512.03262](https://arxiv.org/abs/2512.03262), accepted at ICML 2026), has 186 feature-request tasks drawn from open-source projects, where human programmers had once committed vulnerable code. The authors tested 12 coding-agent setups with frontier models. They report that every agent did poorly on security. In one setup, SWE-Agent with Claude 4 Sonnet, 57% of solutions worked but only 11.8% were secure. Adding vulnerability hints to the request did not fix it. Note that the tasks are chosen because they invite a security mistake, so this is a stress test and not a measure of everyday code.

**Technical debt.** Waseem and colleagues ([arXiv 2512.11922](https://arxiv.org/abs/2512.11922), December 2025) describe a "flow-debt" trade-off: smooth, fast generation builds up technical debt. They link vibe coding to inconsistent architecture, security holes and higher maintenance work. The paper is based on the authors' own experience with several MVPs and a review of industry reports, not a controlled experiment.

**Real usage.** The SWE-chat dataset ([arXiv 2604.20779](https://arxiv.org/abs/2604.20779), accepted at COLM 2026) collects almost 18,000 real sessions between open-source developers and coding agents. It labels sessions where the agent wrote virtually all committed code as vibe coding. They make up 41% of sessions, against 25% where humans wrote everything. Only 59% of agent-written code made it into commits, and users pushed back on the agent in 50% of turns. The authors report that agent-written code introduces more security vulnerabilities than human-written code.

**Speed.** A related question is whether AI makes experienced developers faster at all. In a July 2025 randomized trial by METR, 16 experienced open-source developers completed 246 real tasks. With AI allowed they took 19% longer, though they believed it had sped them up by 20%. METR says the study used early-2025 tools, was small, and has since been superseded by updated results. It was not about vibe coding either, but it shows that how fast the work feels is not a reliable guide.

## When it makes sense

The sources agree on one point: the risk depends on what is at stake. A throwaway script, a personal tool or a prototype to show a colleague costs little if it breaks. An app that handles logins, payments or other people's data does not. For that, the practical advice from both Willison and the research is to read the code, run tests, and scan for vulnerabilities before anything ships.

What the studies cannot yet tell us is how these numbers move as models improve. The security results come from specific agents tested in late 2025, and the authors revised their papers in 2026.

## Frequently asked questions

### Who coined the term vibe coding?

Andrej Karpathy, in a post on X on February 2, 2025. He described fully giving in to the vibes and forgetting that the code even exists.

### Is vibe coding the same as using AI to code?

Not in the strict sense. Simon Willison says it means not reviewing the code the model writes. If you read, test and understand the output, he calls it ordinary software development.

### What tools are used for vibe coding?

Cursor, Claude Code, Lovable and Replit are the most common. Cursor and Claude Code suit people who read code, while Lovable and Replit let you build apps from plain-language prompts.

### Is vibe coding safe?

It carries real risks for anything beyond prototypes. In the SusVibes benchmark, 12 coding-agent setups all scored poorly on security, and a December 2025 paper links vibe coding to technical debt.

## Sources

- [Andrej Karpathy on vibe coding (X post, February 2, 2025)](https://x.com/karpathy/status/1886192184808149383), X
- [Not all AI-assisted programming is vibe coding](https://simonwillison.net/2025/Mar/19/vibe-coding/), Simon Willison
- [Is Vibe Coding Safe? Benchmarking Vulnerability of Agent-Generated Code in Real-World Tasks (arXiv:2512.03262)](https://arxiv.org/abs/2512.03262), arXiv
- [Vibe Coding in Practice: Flow, Technical Debt, and Guidelines for Sustainable Use (arXiv:2512.11922)](https://arxiv.org/abs/2512.11922), arXiv
- [SWE-chat: Coding Agent Interactions From Real Users in the Wild (arXiv:2604.20779)](https://arxiv.org/abs/2604.20779), arXiv
- [Measuring the impact of early-2025 AI on experienced open-source developer productivity](https://metr.org/blog/2025-07-10-early-2025-ai-experienced-os-dev-study/), METR
- [Claude Code](https://claude.com/product/claude-code), Anthropic
- [Lovable documentation](https://docs.lovable.dev/introduction/welcome), Lovable
- [Replit](https://replit.com), Replit
- [Cursor](https://cursor.com), Cursor