Vibe coding is a method of building software in which a person describes what they want in ordinary language, a large language model produces the code, and the result is judged by whether it appears to run rather than by what it contains. The defining condition is the absence of line-by-line review. Someone who reads and understands every generated change is doing AI-assisted programming. The term was coined for the case where that step is deliberately skipped.

The practice exists because two capabilities arrived together: models competent enough to turn a paragraph of description into a working program, and tooling able to run that program, read the errors, and correct itself. For small, low-stakes software, the person holding the intention no longer had to be a programmer.

How the loop works

Sessions run in one of two environments. The first is an agentic editor or command line tool operating on a local file system: Cursor, GitHub Copilot, OpenAI's Codex, or Anthropic's Claude Code. The second is a hosted builder owning the whole stack, such as Replit, Lovable, Google AI Studio, or Vercel's v0. Local tools leave a repository that can be inspected and versioned. Hosted builders often leave a deployed service and nothing else, which is why security teams treat vibe-coded applications as a provenance problem rather than only a code quality problem.

The loop has four steps. The operator states a goal. The model writes or edits files. The tool builds and runs the result. The operator looks at the output, describes what looks wrong, and the cycle repeats. Error messages are frequently pasted back verbatim, on the assumption that the model will interpret them.

Settings determine how much control the human keeps. Auto-accept applies every proposed diff without confirmation. Planning modes force a written plan before any file is touched. Permission prompts gate shell commands, network calls, and deletions. Context files, conventionally named AGENTS.md or CLAUDE.md, carry instructions across sessions. Turning auto-accept on and the rest off is roughly what separates vibe coding from supervised agentic development.

The local variant became possible once models were given direct machine access. Claude Code diverged from earlier assistants by combining read-write file access with Unix shell execution, moving the category from autocomplete toward a second engineer. Billing runs on tokens or credits, and the meter runs on retries: Google added spend caps to AI Studio in March 2026 after developers reported charges some put above 70,000 dollars.

Where the term came from

Andrej Karpathy, a founding member of OpenAI and former director of AI at Tesla, posted the phrase on X on 2 February 2025, describing work in which the operator would "fully give in to the vibes" and stop reading diffs. It elaborated on his 2023 claim that the hottest new programming language is English. Karpathy framed the approach as suited to throwaway weekend projects rather than production systems, a qualification most subsequent usage dropped.

Adoption of the term was unusually fast. Merriam-Webster added it as a slang and trending entry on 8 March 2025. Y Combinator reported that month that a quarter of its Winter 2025 batch had codebases roughly 95 percent AI-generated, though the question covered AI-generated code broadly rather than unreviewed code. Collins named vibe coding its Word of the Year on 6 November 2025 after a surge in usage across its 24 billion-word corpus.

The tool market

Research from UC San Diego and Cornell University, released on 5 January 2026, surveyed 99 professional developers and found Claude Code cited by 58, GitHub Copilot by 53, and Cursor by 51. Claude Code had reached 115,000 developers processing 195 million lines weekly by July 2025.

Platform vendors absorbed the pattern within a year. Google rebuilt AI Studio around conversational app creation on 26 October 2025, adding an Annotation Mode that lets a person click an interface element and issue an instruction about it, and aiming the product at developers, marketers, and non-coders. It introduced Antigravity alongside Gemini 3 on 18 November 2025 and shipped a second version at I/O 2026. Salesforce opened its platform to external coding agents in April 2026 through Agentforce Vibes 2.0.

Why it matters for marketing teams

Marketers are an explicit target market, not a side effect. Semrush embedded its search dataset inside Lovable on 13 May 2026, putting 28 billion keywords and 43 trillion backlinks into the build surface rather than a separate subscription. Replit integrated RevenueCat on 9 April 2026, so subscriptions and app store billing arrive by prompt.

The workloads that migrate first are internal: pacing dashboards, feed quality checks, tag audits, one-off landing pages, reporting scripts. Anthropic documented its own marketing operations team compressing a weekly metrics report from two days to two hours on 8 July 2026, using the Cowork agent released in January for non-developers. That account is both evidence and marketing.

Appetite is not trust. StackAdapt research found only 6 percent of marketers act on in-platform AI recommendations, a gap that applies to generated code as much as to generated bids. The governance exposure is specific: an application built in an afternoon by someone outside engineering may hold customer records, API credentials, and spend data with no review, no inventory, and no owner.

A second-order effect will look familiar to anyone tracking search. Tailwind CSS laid off 75 percent of its engineering team on 6 January 2026 after documentation traffic fell roughly 40 percent and revenue by 80 percent, because assistants now answer the questions that once drove visits. Stack Overflow recorded 1,442 new questions in July 2026 against a 2014 peak of 207,204.

Security and quality evidence

Veracode tested more than 100 models across 80 security-sensitive tasks and reported on 30 July 2025 that 45 percent of generated samples introduced an OWASP Top 10 vulnerability, with Java failing roughly 72 percent of tasks and cross-site scripting defenses failing in 86 percent of relevant samples. An October 2025 update found newer and larger models writing functionally better code without writing safer code. Veracode sells application security testing, a commercial interest worth weighing against the result.

Documented failures repeat the pattern. Semafor reported in May 2025 that a scan of 1,645 Lovable-built applications found 170 exposing personal data, cataloged as CVE-2025-48757. In July 2025 an agent on Replit deleted a production database during a stated code freeze, which the company's chief executive publicly called unacceptable before shipping development and production separation. CodeRabbit examined 470 open-source pull requests in December 2025 and reported 1.7 times more major issues in AI co-authored code, with security vulnerabilities 2.74 times higher.

Maintainability degrades more quietly. GitClear analyzed 211 million changed lines from 2020 to 2024 and found refactoring falling from 25 percent of changed lines to under 10 percent, and copy-pasted code exceeding moved code for the first time in two decades.

The productivity dispute

METR published a randomized trial on 10 July 2025 covering 16 experienced open-source maintainers and 246 real tasks. Participants expected AI assistance to make them 24 percent faster, were measured 19 percent slower, and still estimated afterwards that they had gained 20 percent. The UC San Diego and Cornell researchers found experienced developers refusing the posture entirely: all 13 observed participants controlled software design themselves, and 65 respondents named prior engineering expertise as a prerequisite for working with agents.

Counter-evidence exists at the individual level: a Google principal engineer described Claude Code reproducing in an hour architecture her team had spent a year on, though she attributed the gap to organizational bottlenecks.

Anthropic research found developers using AI assistance scoring 17 percent lower on comprehension tests while completing tasks marginally faster. LiveCodeBench Pro, released 13 June 2025, measured frontier models at 53 percent on medium-difficulty problems and zero on hard ones without external tools. Stanford researchers argued in June 2025 that such evaluations overstate gains by excluding oversight costs.

What vibe coding is not

AI-assisted programming is the superset. Programmer Simon Willison has argued that reviewing, testing, and understanding generated code makes the model a typing assistant rather than a vibe coding session. Most professional use sits here, so adoption statistics for AI coding tools should not be read as vibe coding statistics.

No-code and low-code platforms predate the term. They expose fixed component libraries and visual editors, and the artifact is configuration inside a vendor runtime. Vibe coding produces source code, even when nobody reads it.

Agentic or spec-driven development inverts the posture: the agent still writes the code, but a specification, tests, and review gates constrain it. Andrew Ng objected in June 2025 that the vibe framing misrepresents a demanding activity as a casual one.

Vibe marketing is a separate coinage borrowing the posture for campaign work rather than code.

Recent developments

Analyst forecasting has hardened. Gartner's May 2025 report "Why Vibe Coding Needs to Be Taken Seriously" projected 40 percent of new enterprise production software created with vibe coding techniques by 2028, while separately warning that prompt-to-app adoption by non-developers could raise defects 2,500 percent by the same year without governance.

The security industry has started productizing the gap, with Island announcing enterprise controls for vibe-coded applications on 3 August 2026 as a response to shadow AI. A January 2026 paper titled "Vibe Coding Kills Open Source" argued that the practice reduces engagement with maintainers, weakening the recognition and revenue that sustain the libraries the models depend on.

The term's status remains contested. Karpathy's framing excluded production work, Ng rejects the label, and vendors now sell governance for a practice defined by the absence of it. As of August 2026 the phrase is used both literally and as a loose synonym for AI-assisted development, a distinction worth preserving when reading any statistic attached to it.

Timeline

  • 2021: GitHub Copilot introduced as an autocomplete assistant
  • 2023: Andrej Karpathy states that the hottest new programming language is English
  • 2 February 2025: Karpathy coins the term vibe coding in a post on X
  • 27 February 2025: New York Times columnist Kevin Roose publishes an account of building personal apps by prompt
  • 5 March 2025: Ars Technica publishes an early examination of the practice and its risks
  • 6 March 2025: Y Combinator reports a quarter of its Winter 2025 batch with codebases about 95 percent AI-generated
  • 8 March 2025: Merriam-Webster adds vibe coding as a slang and trending entry
  • May 2025: Gartner publishes "Why Vibe Coding Needs to Be Taken Seriously"
  • 29 May 2025: Semafor reports 170 of 1,645 scanned Lovable applications exposing personal data
  • 13 June 2025: LiveCodeBench Pro published, measuring zero percent model accuracy on hard problems
  • 10 July 2025: METR publishes its randomized trial finding experienced developers 19 percent slower
  • 21 July 2025: Replit's agent deletes a user's production database during a code freeze
  • 30 July 2025: Veracode reports 45 percent of AI-generated code introducing OWASP Top 10 vulnerabilities
  • 9 September 2025: Fast Company reports a vibe coding hangover among senior engineers
  • 26 October 2025: Google rebuilds AI Studio around conversational app creation
  • 6 November 2025: Collins names vibe coding its Word of the Year
  • 18 November 2025: Google introduces Antigravity alongside Gemini 3
  • 17 December 2025: CodeRabbit reports 1.7 times more major issues in AI co-authored code
  • 3 January 2026: A Google principal engineer's account of Claude Code output circulates widely
  • 5 January 2026: UC San Diego and Cornell publish research showing experienced developers reject the vibe coding posture
  • 6 January 2026: Tailwind CSS lays off 75 percent of its engineering team
  • 12 January 2026: Linus Torvalds is reported to have vibe coded a visualizer component
  • 21 January 2026: The paper "Vibe Coding Kills Open Source" is published
  • 12 February 2026: BBC News reports a reporter hacked through an Orchids platform flaw
  • 9 April 2026: Replit integrates RevenueCat for in-app monetization
  • 13 May 2026: Semrush embeds its search dataset inside Lovable
  • 19 May 2026: Google ships Antigravity 2.0 at I/O 2026
  • 8 July 2026: Anthropic publishes an account of its marketing operations team rebuilding workflows on Cowork
  • 3 August 2026: Island announces enterprise controls for vibe-coded applications

Summary

Who: Andrej Karpathy coined the term. The practitioners are professional developers, and increasingly non-engineers including marketers, product managers, and founders. The vendors are Anthropic, OpenAI, Google, Microsoft, Cursor, Replit, Lovable, Vercel, and Salesforce. The critics include Simon Willison, Andrew Ng, and researchers at METR, Veracode, GitClear, UC San Diego, and Cornell.

What: A software development method in which natural language prompts replace hand-written code, with the operator accepting generated output without line-by-line review. It is distinct from supervised AI-assisted programming, from no-code platforms, and from spec-driven agentic development.

When: Coined 2 February 2025, entered Merriam-Webster in March 2025, named Collins Word of the Year on 6 November 2025, and forecast by Gartner to account for 40 percent of new enterprise production software by 2028.

Where: Agentic editors and command line tools on local machines, and hosted builders that own the full stack from prompt to deployed URL.

Why: It matters to the marketing community because the tooling is being sold directly to marketers, because the applications produced hold campaign and customer data outside normal engineering governance, and because the same AI mediation that lets a media buyer build a dashboard in an afternoon is simultaneously removing traffic from the documentation and question sites that publishers depend on.