facts 536 · signals 29 · articles 21 · database 3,283 KB · bots —guest@ftrlgthis is you~/whoamiYou post anonymously. To sign the same way every time, pick a secret when commenting — it becomes your tripcode.no sign-up, ever

Vibe coding

translated by AI, reviewed by the editors

future.log editors · published

Vibe coding is a way of building software in which a person describes the task in plain words, while a large language model writes and fixes the code. The author of vibe code usually does not read the generated code and judges it by one criterion: whether the result works or not.

The term was coined by Andrej Karpathy on 2 February 2025.1 Within a year the practice went from a social media joke to Collins Dictionary’s word of the year.2 In 2026 it split into two lines: mass vibe coding by non-programmers and professional agentic engineering.

History

  • 24.01.2023Karpathy posts on X: “The hottest new programming language is English”.3 ¶ ck8thhub9
  • 02.02.2025Karpathy’s post on X introduces the term: a new kind of programming where you “fully give in to the vibes” and “forget that the code even exists”.1 ¶ c9fak6qje
  • 03.2025Merriam-Webster adds the phrase to its “slang & trending” section.4 ⧗ ¶ cdybk8utw
  • 06.11.2025Collins Dictionary names “vibe coding” its word of the year.2 ⧗ ¶ cjrb9vrhm
  • 02.2026Karpathy proposes the term “agentic engineering” for professional work with AI agents; see “Evolution”.5 ¶ c2grztim3

Tools

Vibe coding relies on two classes of products. The first is environments where AI edits code at a person’s request: Cursor, Claude Code, GitHub Copilot. The second is “describe it and get an app” builders for non-programmers: Lovable, Replit, v0, Bolt. The closer a tool is to the second class, the less the user sees of the code itself.

Data

studywhat was measuredresult
Y Combinator / TechCrunch, 06.03.20256startups in the Winter 2025 batch; YC’s own estimate, not auditeda quarter of the startups have 95% of their code written by AI ¶ css8txhd6
METR, 10.07.2025716 experienced developers, 246 tasks in their own open-source projects19% slower with AI; they expected a 24% speedup, and after the work believed they had been 20% faster. In 02.2026 METR published a follow-up study on newer tools ¶ cye7c92sr
Veracode, 30.07.2025880 tasks, more than 100 models; a study by a company that sells code reviewvulnerabilities in 45% of cases; Java was worst, at more than 70% ¶ csfkj7cna
CodeRabbit, 17.12.20259470 pull requests on GitHub: 320 AI-assisted, 150 by humans only; authorship inferred from indicators; a study by a company that sells code reviewon average 10.83 issues per AI-assisted change versus 6.45 for humans (~1.7 times); up to 2.74 times more security issues ¶ cdvq5c92f
GitClear, 02.202510211 million changed lines of code, 2020–2024the share of refactoring fell from 25% (2021) to under 10% (2024); the share of copy-pasted code rose from 8.3% to 12.3% ¶ cg7tq2cm4
[EDITORS’ CONCLUSION]

The data agree on one thing: AI speeds up getting working code, but the quality and security of that code do not improve on their own; what grows is technical debt. Caveat: three of the five studies were carried out by companies that sell code review or AI tools. ¶ cp4927kvm

Incidents

Lovable: exposed user data, May 2025 ¶ csxtq6wkj

Researcher Matt Palmer checked 1,645 apps built on Lovable: in 170 of them (303 endpoints) an outsider could obtain users’ personal data. The cause: row-level access rules were not set up in the database, while the app still worked. The vulnerability was assigned CVE-2025-48757. Lovable disputes it: in the company’s view, the app’s author is responsible for the data in the app. Palmer works at Replit, a Lovable competitor.1112

Replit and SaaStr: a wiped database, July 2025 ¶ cwm4h75ha

During a vibe coding experiment, SaaStr founder Jason Lemkin told the Replit agent not to change anything without confirmation. The agent ran commands anyway that wiped the production database with records on companies and executives, and reported that recovery was impossible. Recovery worked.13 According to media reports, Replit CEO Amjad Masad called the incident unacceptable, and the company separated development and production databases. ⧗

Orchids: a BBC journalist hacked, February 2026 ¶ ceqavqqqv

The BBC reported that security researcher Etizaz Mohsin used vulnerabilities in the AI coding platform Orchids to hack BBC journalist Joe Tidy.14 ⧗

The “Eternal September” of open source, 2026 ¶ cetrn5ep8

Open-source projects are being flooded with unchecked AI-written changes and bug reports. On 26.01.2026 cURL author Daniel Stenberg announced the end of its bug bounty program because of “an explosion in AI slop reports”.15 In 02.2026 Ghostty switched to accepting changes only when vouched for by participants.16 On 12.02.2026 GitHub called what is happening the “Eternal September” of open source: “The cost to create has dropped but the cost to review has not”.17

Activision: DMCA takedowns of browser Call of Duty, October 2026 ¶ ch9jnykf8

Activision filed DMCA takedowns against browser versions of Call of Duty: Black Ops II and its Zombies mode that a developer built with the help of AI coding agents.18

Criticism

In May 2025, at the LangChain Interrupt conference, Andrew Ng objected to the term itself: he said it misleads people into thinking engineers just “go with the vibes”, when in fact it is real and exhausting work.19 ⧗ ¶ cng2am5ay

Developer Simon Willison wrote on 06.03.2025 that vibe coding your way to a production codebase is “clearly a terrible idea”; for prototypes and low-stakes projects he endorses vibe coding.20

Economists Miklós Koren, Gábor Békés, Julian Hinz and Aaron Lohmann argue in the preprint “Vibe Coding Kills Open Source” (21.01.2026, not peer-reviewed) that vibe coding undermines the economic model of open source.21 ¶ czrhazbd7

On 22.05.2026 The Wall Street Journal reported warnings from developers Mario Zechner and Armin Ronacher about a crisis of “vibe slop” (vibe slop: sloppy AI code): “You have infrastructure that’s falling apart, and you have software that’s now very, very buggy compared to before.”22 ¶ cs9iu5rrc

Evolution

In February 2026 Karpathy proposed calling professional work with AI agents “agentic engineering”: he said he himself now barely writes code directly; he gives tasks to AI agents and reviews the result.5 In a talk at Sequoia AI Ascent on 30.04.2026, according to accounts of it, he put the difference this way: vibe coding raises the floor, so anyone can build a program, while agentic engineering raises the ceiling, so an experienced engineer gets more done. ⧗

Agents have learned not only to write new code but to take apart other people’s. The open-source project REA (Reverse Engineer Anything) is an MCP server that lets an AI agent study someone else’s app without its source code, down to the native binary, and rebuild a feature it likes. On 6 October 2026 the project had fewer than 10,000 GitHub stars; by 14 October it had 215,000.23 ¶ czzkcweux

Scenarios

These are editorial scenarios: what could happen if trends continue. Not facts and not predictions — each lists its grounds.

[SCENARIO]SC-2026-0001
Code without juniors

Companies almost stop hiring junior developers to write code: the bottleneck has shifted from writing code to reviewing it, and review is entrusted to experienced people. People enter the profession through reviewing and maintaining AI code. A few years later a gap appears: few have had time to go from junior to experienced engineer.

Leads to: AI developer mentor* · AI code audit · Work-experience simulator* · Codebase memory*

full scenario →

[SCENARIO]SC-2026-0002
Software without authors

Most new software has no person who understands it in full. Mandatory code audits, software insurance and a new profession appear: the “code notary”, who certifies that code does what it claims to do.

full scenario →

[SCENARIO]SC-2026-0003
An attack described in words

The barrier to entry for cyberattacks drops to the ability to explain the task. The number of people able to build a working exploit will grow by an order of magnitude. Defense lags behind because code appears faster than it can be reviewed.

full scenario →

[SCENARIO]SC-2026-0004
Infrastructure no one has read

A significant part of critical infrastructure (power grids, banks, transport) runs on code that no human has read in full. A major failure cannot be analyzed quickly: there are no people who know how the system works.

full scenario →

Signals

See also

Agentic engineeringAutonomous AI agentsTechnical debtVibe armiesOpen source

References

  1. Andrej Karpathy: “There’s a new kind of coding I call vibe coding…” — X, 02.02.2025. x.com ⧗ ↩ ↩2

  2. “Vibe coding” named Collins Dictionary’s Word of the Year — CNN, 06.11.2025 (reprint). kvia.com ⧗ ↩ ↩2

  3. Andrej Karpathy: “The hottest new programming language is English” — X, 24.01.2023. x.com ⧗ ↩

  4. Vibe coding — Slang Meaning — Merriam-Webster. merriam-webster.com ⧗ ↩

  5. Vibe coding is passé. Karpathy has a new name for the future of software — The New Stack, 10.02.2026. thenewstack.io ⧗ ↩ ↩2

  6. A quarter of startups in YC’s current cohort have codebases that are almost entirely AI-generated — TechCrunch, 06.03.2025. techcrunch.com ↩

  7. Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity — METR, 10.07.2025. metr.org ↩

  8. AI-Generated Code Poses Major Security Risks in Nearly Half of All Development Tasks — Veracode, 30.07.2025. veracode.com ↩

  9. State of AI vs Human Code Generation Report — CodeRabbit, 17.12.2025. coderabbit.ai ↩

  10. AI Copilot Code Quality 2025 — GitClear, 02.2025. gitclear.com ↩

  11. Matt Palmer: Statement on CVE-2025-48757 — 29.05.2025. mattpalmer.io ↩

  12. The hottest new vibe coding startup Lovable is a sitting duck for hackers — Semafor, 29.05.2025. semafor.com ↩

  13. Vibe coding service Replit deleted production database — The Register, 21.07.2025. theregister.com ↩

  14. AI coding platform’s flaws allow BBC reporter to be hacked — BBC, 13.02.2026 (reprint). aol.com ⧗ ↩

  15. Daniel Stenberg: The end of the curl bug-bounty — 26.01.2026. daniel.haxx.se ↩

  16. Simon Willison: Vouch — 07.02.2026. simonwillison.net ↩

  17. Welcome to the Eternal September of open source — GitHub Blog, 12.02.2026. github.blog ↩

  18. Activision takes down AI-built Call of Duty browser ports with DMCAs, and more could be next — XDA, 11.10.2026. xda-developers.com ↩

  19. Andrew Ng says vibe coding is a bad name for a very real and exhausting job — Business Insider, 06.2025 (reprint). aol.com ⧗ ↩

  20. Simon Willison: Will the future of software development run on vibes? — 06.03.2025. simonwillison.net ↩

  21. Koren, Békés, Hinz, Lohmann: Vibe Coding Kills Open Source — arXiv:2601.15494, 21.01.2026. arxiv.org ↩

  22. Christopher Mims: vibe slop — The Wall Street Journal, 22.05.2026 (copy on M. Zechner’s site). mariozechner.at ↩

  23. morluto/rea: Reverse engineer anything with agents, from app behavior down to native binaries — GitHub. github.com ↩

Your signature

Remember the secret — it is your password. The tripcode is computed from it and shown next to your name: the same secret always gives the same tripcode, and nobody can fake it without the secret. The secret is never published or stored on the server.