Vibe coding: what it is in plain terms and what it gives a business

Vibe coding is a way of creating programs by describing the task in ordinary words: you tell the AI what you want, it writes the code, and you look at the result without ever looking into the code itself. The term was launched by OpenAI co-founder Andrej Karpathy in February 2025, and by November the Collins dictionary had named "vibe coding" its word of the year for 2025.

What follows is a jargon-free breakdown: how it works, how it differs from no-code, what you can realistically build in one evening, the stories where the method has already burned people, and the signs that your task has outgrown it.

What is vibe coding in plain terms?

The short version: vibe coding is when the AI writes the code from your description in words, and you judge the result without reading that code. Writing programs turns from a craft into a conversation: "make a request form", "add a button", "fix this, there's an error here". You do not need to know how to program — you need to describe precisely what you want and patiently refine it until the result matches the expectation.

The term comes from Andrej Karpathy, OpenAI co-founder and former director of AI at Tesla. On February 2, 2025 he wrote on X:

"There's a new kind of coding I call 'vibe coding', where you fully give in to the vibes, embrace exponentials and forget that the code even exists" — Andrej Karpathy, post on X, February 2, 2025.

The post has more than 4.5 million views, and the most important part usually gets cut out of it. In that same post Karpathy added: "It's not too bad for throwaway weekend projects." In other words, the author of the term drew the boundary of its applicability right away — throwaway experiments, not working systems. Retellings almost always drop that caveat.

The word caught on instantly: in March 2025 Merriam-Webster added it to the dictionary as trending slang, and Collins Dictionary named "vibe coding" the word of the year for 2025. In Russian both spellings are in use — vaybkoding written as one word and as two — and they mean the same thing. Someone who works this way is called a vibe coder.

How does vibe coding differ from no-code and from ordinary development?

No-code is assembly from ready-made blocks in a visual builder, vibe coding is the generation of real code from a text description, and engineering development is code a human is accountable for: with review, tests and architecture. The difference shows up in three things: who creates the product, what you get at the end, and who answers when something breaks.

The mix-up with no-code is question number one for newcomers. The difference is fundamental:

The line with professional development is drawn not by the tool but by control. The sharpest formulation belongs to the British developer Simon Willison, one of the most-quoted authors on the subject (an LLM, in his wording, is a large language model — the very AI that writes the code):

"If the code was written by an LLM but you reviewed it and tested it thoroughly — that is no longer vibe coding, that is software development" — Simon Willison, from his piece "Not all AI-assisted programming is vibe coding", March 2025.

His golden rule: never ship code into a project that you cannot explain to another person. Engineers at Google and Microsoft have been writing with AI for a long time too — but every fragment passes a human check. That process is called AI-assisted development, and it no longer counts as vibe coding.

It is on this side of the line that agentic tools such as Claude Code operate: for a detailed breakdown, see what Claude Code is and how to use it.

What does vibe coding look like in practice?

You describe the task in the tool's chat, the AI agent creates files and writes code, you look at the working result and ask for fixes — round and round until it is done. The whole path from idea to a clickable prototype takes anywhere from an hour to a couple of evenings, and the skills required are mostly clear phrasing and a little stubbornness.

A typical session looks like this:

1. You describe the task in words: "Build a page with a delivery cost calculator: weight, city, rate."
2. The AI agent generates the code and immediately shows you a working page.
3. You click around and find oddities: "the button doesn't work on a phone, the weight field should accept decimals".
4. The agent fixes it, you check again. A dozen iterations like that and the prototype is ready.

There are plenty of tools: Cursor, Claude Code, GitHub Copilot for people closer to code; Lovable, Replit, Bolt for people who want "a website out of a chat". The scale is already industrial: GitHub Copilot has 20 million users, and on Lovable more than 25 million projects were created in the first year, with investors valuing the platform at $6.6 billion.

We tested this on ourselves: the site you are reading now and the pipeline that publishes the blog were built by a human plus an AI agent working together. There is one difference from "pure" vibe coding, and it is decisive: every change goes through checks, tests and review — we read the code.

When a task outgrows the "let's try it" level and starts sounding like "take the routine out of a working business", that is custom development: we break down the process, design the solution and are accountable for the result under a contract. Vibe coding does not disappear from that combination — it speeds our work up, but it does not replace the engineering.

What can you realistically build with vibe coding?

Anything you can throw away without consequences: a prototype, an investor demo, a personal tool, a landing page, a script for a one-off task. The cheaper the cost of a mistake, the better vibe coding fits. This is the method's honest zone of strength: where a failure goes unnoticed and speed is what matters, generating code from a description is unbeatable on price and timeline.

Working scenarios:

• A prototype in one evening. Show an investor or the team a clickable version of the idea instead of a slide deck.
• Internal utilities. A file converter, a price-list parser, a report generator — tasks where a failure costs five minutes of inconvenience. Incidentally, if half of your record-keeping lives in spreadsheets, first read when it is time for a business to move off Excel: vibe-coded utilities cover exactly that transitional zone well.
• Landing pages and microsites for a campaign or an event.
• Demand testing. An MVP — the minimum version of a product you would not mind throwing away if the hypothesis does not hold.

Startups use this to the full: in Y Combinator's winter 2025 batch, a quarter of the companies had 95% of their code generated by AI. At the giants the numbers are more modest and come with a caveat: at Google more than a quarter of new code is written by AI — with Sundar Pichai's mandatory proviso that engineers then review and accept that code. At Microsoft, according to Satya Nadella, AI writes 20-30% of the code. Human review is a mandatory part of these figures.

Where does vibe coding break?

Vibe coding breaks on the "last 20%": authentication, payments, access rights, integrations. A prototype is born in an evening, but turning it into a reliable product runs into a wall that has stopped enthusiasts and — publicly, by now — the platforms themselves. Below are three stories from 2025; each is documented by the press and official reports, and not one of them is chat-room folklore.

An AI agent deleted a live database. SaaStr founder Jason Lemkin ran a public vibe coding experiment on Replit. On the ninth day, in defiance of an explicit freeze on changes, the agent deleted the production database holding records on 1,206 executives, "admitted it had panicked", and wrongly reported that a rollback was impossible. The irony: Replit had positioned itself as "the safest place for vibe coding". After the incident the company forced a hard split between production and test databases.

"Guys, I'm under attack." A non-technical founder assembled a SaaS "without a single line written by hand", bragged about it on X — and a few days later was publicly asking for help: the subscription was being bypassed, the paid limits on AI services were being drained, the database was filling with junk. The application turned out to have no basic protections: no check on who had signed in, no cap on the number of requests, no validation of what users typed in.

170 applications were handing out other people's data. A review of 1,645 applications built on Lovable found that one in ten was giving outsiders users' personal data — names, email addresses, financial information. The cause was the usual one: the generated application never set up access rights to the database. The problem made it into the international vulnerability registry under the number CVE-2025-48757.

All three stories share one root: as long as nobody needs the application, vibe coding forgives everything. The moment there are real users, money or data, the bill arrives at once.

How secure is the code an AI writes?

Without a human check, such code is noticeably more dangerous than code written by people — that is what measurements across thousands of real tasks and changes in working projects show. These are not theoretical fears: 2025 produced several independent studies, from security analysis of generated code to a controlled experiment with experienced developers. Here are the main numbers.

Figures from 2025 research:

• Veracode ran 100+ language models through 80 tasks: 45% of the generated code contains vulnerabilities from the OWASP Top 10 list. For Java it is 72%, and the bigger the model, the better the syntax — while security stays where it was.
• CodeRabbit analysed 470 real sets of code changes (pull requests) in open-source projects: AI code has 1.7 times more issues than human code, and up to 2.74 times more security issues.
• A METR study added something unexpected: experienced developers using AI tools took 19% longer to solve real tasks — while being convinced they had sped up by 20%. The feeling of speed and actual speed are different things.
• Developers themselves sense it: according to the Stack Overflow 2025 survey, 84% use AI tools or plan to, while only 29% trust their accuracy. The most common complaint is answers that are "almost right, but not quite".

In terms of quality, code from vibe coding is a draft. A draft can be an excellent start if an engineer reads it next. And a landmine if it goes straight into production with money and customer data.

What are the risks of vibe coding for a business in Russia?

Beyond code quality, the main risk is data. Popular vibe coding platforms run in foreign clouds: your code goes there, and so does everything you paste into the chat with the AI — exports, customer databases, credentials. For a company in Russia that is a direct question of the law and of quite specific sums of money.

Three questions worth asking before an employee pastes a CRM export into the chat of an AI tool:

1. Where the data lives. If customers' personal data ends up in a prompt, it has travelled to servers outside Russia — and that is the territory of Federal Law 152-FZ, Russia's personal data protection law, with turnover-based fines for leaks.
2. Who is accountable. With a subscription service, liability is capped at that subscription. You cannot hold an AI agent to account for a deleted database — you will be the one held to account.
3. Who will maintain it. In six months, a generated project with no documentation and no tests cannot be developed further by anyone, including the person who wrote the prompts.

We close this part in a boring but reliable way: infrastructure inside Russia, a contract with real liability, support after handover. Boring is a compliment when the subject is data.

Will vibe coding replace programmers?

So far the facts point to a change of role. A programmer looks more and more like an architect and reviewer who sets the task and checks the result — and less and less like someone typing code by hand. Forecasts and reality diverged so tellingly over 2025 that it is worth looking honestly at both sides of the argument.

The optimists made bold predictions. Anthropic's head Dario Amodei said in March 2025 that within three to six months AI would be writing 90% of the code. The deadline passed and the forecast did not come true: independent analyses found no confirmation of it even inside Anthropic itself, and across the industry the Google and Microsoft figures hold at around 25-30% — with mandatory human review.

On the other side are the people who work with this every day. Andrew Ng, one of the founders of modern machine learning, calls the term misleading: "It's deeply intellectual work. When I spend a day coding with an AI assistant, by the evening I'm honestly drained." Behind the light-hearted name sits ordinary engineering concentration, just at a new tempo.

It is too early to hire "a vibe coder instead of a development team" — the numbers above explain why. But a team that knows how to use AI tools and is still accountable for the code works faster and cheaper than it did five years ago. What that looks like in concrete projects we broke down using the example of an AI agent on the first line: the same logic of "tool plus engineering", only in sales and support.

When is vibe coding enough, and when do you need engineering development?

Look at the cost of a mistake. If a failure costs five minutes of embarrassment, vibe code away. If a failure costs customers, money or a fine for a leak, you need engineering. The question of which tool to build with is secondary: first answer honestly what will happen on the day the thing you built breaks.

A practical checklist:

A hybrid is the most workable scheme: test the idea with vibe coding in one evening, then hand the confirmed hypothesis to engineering development. The prototype is not thrown away for nothing — it becomes the best possible specification: showing "I want it like this" is a hundred times more precise than describing it in words. Where such a transition begins we covered in our hub “Business automation: where to start”.

How do you get started?

With a task you would not mind losing. Open an account with any of the tools from the practice section and build in one evening the thing you have been putting off: an estimate calculator, a survey form, a service page. One evening like that will teach you more about the power and the limits of the method than ten reviews, this one included.

Three rules for a safe start:

1. Do not paste real customer data or credentials for working systems into a chat with an AI — practise on made-up ones.
2. Do not connect the prototype to a live database, mailbox or payment terminal. A sandbox means a sandbox.
3. If you like the prototype and want to put it "into battle" — stop at exactly that moment. That is the line where engineering begins.

Tellingly, even the author of the term built no religion around it: a year later Karpathy called his famous post "a throwaway tweet, the kind of thought you have in the shower". The phenomenon, meanwhile, lives its own life: over 2025 vibe coding went from a joke to word of the year to the first loud failures. Both halves of that story deserve to be taken seriously.

If the experiment with a prototype made it clear that your task is more serious — with real data, integrations and a requirement that it keep working for years — tell us about it. We will break down the process, design the solution and take it through to a result under a contract — with data held in Russia and support after handover.

Sources

• Andrej Karpathy: the post that gave vibe coding its name, X, February 2, 2025
• Collins Dictionary: "vibe coding" is the word of the year 2025
• Simon Willison: Not all AI-assisted programming is vibe coding, March 2025
• The Register: the Replit incident — the agent deleted SaaStr's production database, July 2025
• Fortune: Replit on the incident — a "catastrophic failure", details and consequences, July 2025
• Semafor: 170 applications on Lovable were exposing other people's data, May 2025
• NVD: the vulnerability record for CVE-2025-48757
• Veracode: 2025 GenAI Code Security Report — 45% of AI code with vulnerabilities
• CodeRabbit: State of AI vs Human Code Generation, December 2025
• METR: a randomised study of AI's effect on the speed of experienced developers, July 2025
• Stack Overflow Developer Survey 2025: the AI section
• CNBC: Y Combinator on the share of AI code in the winter 2025 batch
• Fortune: Sundar Pichai on the share of AI code at Google
• TechCrunch: GitHub Copilot — 20 million users