Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
AI vibe coding is a way to create or change software by describing what you want to an AI coding model, running the generated result, and refining it through conversation. In the strict sense, the person accepts the AI’s code without reading or understanding it. The term is also used more broadly for AI-assisted coding that includes testing, review, or manual edits, so the distinction matters.
What does AI vibe coding mean?
Vibe coding describes a conversational development workflow: a person states a goal in ordinary language, an AI coding model generates or modifies software, and the person runs the result and asks for changes. Rather than writing every line directly, the person steers the work through prompts and feedback.
Andrej Karpathy introduced the phrase in February 2025. Martin Fowler’s May 21, 2026 explainer reproduces Karpathy’s description: “There’s a new kind of coding I call ‘vibe coding’, where you fully give in to the vibes, embrace exponentials, and forget that the code even exists.” Fowler also recounts Karpathy’s description of accepting changes without reading diffs and feeding error messages back into the model. Martin Fowler’s explanation of vibe coding
The label does not have one universally agreed boundary. The Open Source Security Foundation’s glossary and Fowler use the narrower definition: if you review or understand the generated code, it is not vibe coding in the strict sense. In everyday conversation, people may use the term for a wider range of AI-assisted development, including work where they inspect and edit the output. OpenSSF’s vibe coding glossary entry
#1 Best Overall
How does the workflow work?
- Describe the change. Tell an AI coding model what application, feature, or fix you want in natural language.
- Generate or modify code. The model produces a new project or changes existing files.
- Run the result. Launch the application or run tests to see what works and what fails.
- Give feedback. Describe an error or request a change, then repeat the cycle.
In strict vibe coding, the person does not read the code changes. Observed practice can be less hands-off: a 2025 Microsoft Research study found participants prompting models, testing applications, rapidly scanning output, and sometimes editing code manually. The study’s conclusion is that programming expertise is redistributed toward managing context, evaluating outputs, and deciding when to switch from AI-driven work to manual code changes. Microsoft Research’s 2025 study
Is vibe coding the same as AI-assisted or agentic programming?
Not necessarily. The most useful distinction is how much responsibility the person takes for the generated code. Reviewed AI-assisted work can use the same conversational tools, but a person inspects, tests, and accepts responsibility for the changes. In strict vibe coding, they guide the output without understanding or reviewing the code itself. Fowler contrasts that narrower practice with reviewed agentic programming.
| Approach | How the person works | Typical intent |
|---|---|---|
| Strict vibe coding | Prompts, runs the result, and iterates without reading or understanding the code. | Often a quick experiment or disposable software. |
| Reviewed AI-assisted or agentic programming | Uses AI to generate or change code, then inspects, tests, and may edit it directly. | Can support more consequential work when appropriate review and controls are in place. |
These are practical distinctions, not rigid product categories. A single project can move between prompting, testing, code review, and manual editing. Cursor, GitHub Copilot, Replit, and Lovable are examples of environments named in the sources; they are tools, not synonyms for vibe coding, and their features can change. Microsoft Research and Martin Fowler
Does vibe coding still require programming skill?
Yes, especially when the result matters beyond a private experiment. The work may require less direct typing, but someone still has to express the goal clearly, provide relevant context, judge whether the software behaves as intended, recognize when an error needs a different approach, and decide when to inspect or edit code. Microsoft Research’s observed sessions support this distinction: prompting did not remove expertise; it shifted where that expertise was used.
Is AI vibe coding safe for production?
Not by default. Software that appears to work can still contain defects, security weaknesses, or code that is difficult to maintain. The risk depends on what the software does, what data it handles, and who relies on it. Martin Fowler advises treating unreviewed results as disposable and limiting them to the author or a small group that understands and accepts the risks. Martin Fowler’s guidance
ISACA’s August 2025 guidance offers a practical risk-based distinction. It recommends stronger review as software reaches users, handles important data, or affects regulated and high-impact systems. This is professional guidance, not a universal legal rule. ISACA’s risk guidance for vibe coding
Rank #4
| Use case | Risk posture | Practical approach |
|---|---|---|
| Prototype, documentation tool, test-data generator, or non-production internal script | More suitable for experimentation when it uses no real customer data. | Use lightweight review and keep the work separate from production systems. |
| Data integration, customer-facing interface, business logic, or third-party connector | Higher risk because defects can affect users, information, or other systems. | Use human review, version control, and staging tests. |
| Regulated, financial, healthcare, or identity system | High impact; casual, unreviewed use is inappropriate. | Restrict or prohibit vibe coding unless deep review, traceability, and compliance controls are in place. |
What security risks should you watch for?
One risk discussed by IBM is package hallucination: an AI tool may suggest the name of a software package that does not exist. An attacker could register that name with malicious code, a technique IBM describes as “slopsquatting.” This is a possible attack path, not evidence that every package suggestion from an AI tool is malicious. IBM also notes that large changes spanning many files can make review harder. IBM’s analysis of vibe coding security risks
For anything beyond a disposable experiment, treat generated code like code from an unfamiliar contributor: inspect changes, verify dependencies, run tests, and use a staging environment before deployment. The less you review, the less confidence you can place in correctness, security, and maintainability.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
