What Is Vibe Coding? Meaning, Tools, and Risks Explained

Vibe coding is the practice of describing what you want a program to do in plain English — or another natural language — and letting an AI coding assistant write, run, and fix the actual code, with the person largely steering by feel rather than reading every line. The term comes from AI researcher Andrej Karpathy, who described a workflow where you "fully give in to the vibes" and "forget that the code even exists," and it has since become the default description for a whole category of AI-assisted and AI-agentic development, from quick personal apps to production features built with tools like Claude Code, GitHub Copilot, Cursor, Replit Agent, and Lovable.

What does "vibe coding" actually mean?

Dictionary-maker Merriam-Webster added "vibe coding" to its dictionary with a fairly neutral core definition: "the act or practice of using an artificial intelligence system to generate computer code," usually in a specified programming language, based on a natural-language description of what the code should do. The entry notes the word can also be spelled "vibecoding" or "vibe-coding," and that it can function as a modifier, as in "a vibe coding platform."

Merriam-Webster's slang watch-list entry for the term adds a sharper, more casual flavor: writing code in a somewhat careless way, by describing a program to an AI system and accepting its output, rather than writing or reviewing the code by hand. That second, looser sense is closer to how the phrase is actually used day to day — it implies not just "AI wrote the code" but "AI wrote the code and I didn't scrutinize it closely."

Where the term came from

Vibe coding traces to a specific, dated post. According to Merriam-Webster's etymology note, the term "was apparently introduced in a message posted to the social media platform X" on February 2, 2025, by Andrej Karpathy — a researcher and co-founder of OpenAI who has also led AI efforts at Tesla. His post reads, in part: "There's a new kind of coding I call 'vibe coding,' where you fully give in to the vibes," embrace exponentials, "and forget that the code even exists." Merriam-Webster lists 2025 as the term's first known use.

The phrase caught on fast precisely because it named something a lot of people were already doing with AI coding assistants but hadn't labeled: letting a model generate large chunks of a program from a description, then nudging it with follow-up prompts and pasted error messages instead of editing code directly. Within a year it had moved from a niche developer meme to a term dictionaries track and companies build marketing around.

How vibe coding actually works, day to day

Strip away the branding and vibe coding sessions tend to follow a similar loop across tools:

• Describe the goal. You write a prompt describing what you want — "build a waitlist page with an email form that saves to a database" — instead of opening a blank file and writing code yourself.
• The assistant plans and generates. A coding agent reads relevant files (or scaffolds new ones), decides on an approach, and writes the code, often across multiple files at once.
• You watch it run. Many tools execute commands, run tests, or render a live preview as part of the loop, rather than just handing back a code block.
• You react in natural language. Instead of debugging line by line, you describe what's wrong — paste an error message, describe a visual glitch, or just say "that's not quite right" — and the assistant revises.
• Repeat until it looks done. The session continues, often for many turns, until the output seems to satisfy the original request.

That last step is where the "vibes" come in: the loop can continue on feel and appearance rather than on a formal spec, and especially for people without a programming background, satisfaction is often "it works when I click around" rather than "I verified the logic."

Vibe coding vs. traditional coding vs. context engineering

"Vibe coding" is often used loosely to cover anything from a hobbyist building a weekend app to a professional engineer directing an agent through a complex migration. It helps to separate three related but distinct modes of working with code and AI:

That third column matters because the term's own coiner has since pushed back on treating all AI-assisted development as interchangeable with careless vibe coding. Karpathy has proposed "agentic engineering" as a more deliberate successor term for serious, reviewed work with coding agents, and Anthropic's own guidance for Claude Code — covered below — is built around exactly this kind of structured review rather than pure vibes. For a broader look at how AI agents operate generally, see this site's plain-English explainer on AI agents.

The tools people use for vibe coding

No single product "is" vibe coding — it's a style of working that spans terminal tools, IDE extensions, and full hosted app builders. Here's what the major named tools actually are, according to their own documentation:

These tools differ in how much they expect you to read the code they produce. Claude Code and GitHub Copilot's agent mode are explicitly designed to be steered by a developer who reviews diffs and approves actions; Replit Agent and Lovable are marketed more toward people with no coding background building an app end to end. That gap matters for how much "vibes" versus review is actually happening in any given session. This site has previously compared several of these products directly in its guide to Cursor, GitHub Copilot, Claude Code, and Codex pricing, and in its look at which of Copilot or Claude Code fits a given workflow.

The real risks of vibe coding

The same workflow that makes vibe coding fast is what creates its most common problems. Three stand out, and all three are acknowledged, in some form, by the tool makers themselves.

Unreviewed code

GitHub's own responsible-use documentation for its Copilot coding agent is direct about this: generated code "may appear plausible" yet be "semantically or syntactically incorrect," and it "may not always be secure" even when it runs without errors. The same documentation recommends that people "review all outputs generated by the agent thoroughly prior to merging" and apply the same secure-coding and code-review practices they'd use for code written by a human. When the whole appeal of vibe coding is skipping that close reading, this is the step most likely to get skipped too.

Skipped input validation, authentication, and rate limiting

Because a natural-language prompt rarely spells out every security requirement, an AI assistant optimizing for "does this look like it works" can quietly omit basic safeguards — checking and sanitizing user input, enforcing authentication on routes that need it, or rate-limiting endpoints that could otherwise be abused. GitHub's guidance flags this general class of problem explicitly, noting that Copilot's coding agent "automatically analyzes the newly generated code for security vulnerabilities" using tools like CodeQL and attempts to fix what it finds — an acknowledgment, built into the product, that the underlying generation step can't be trusted to get this right unassisted. Automated scanning helps, but it's a backstop, not a substitute for a person who understands what the application is supposed to protect against.

Context drift in long sessions

The longer an agentic coding session runs, the less reliable it tends to get. Anthropic's own best-practices guide for Claude Code states this as a design constraint, not a minor caveat: the context window — everything the model has read and been told in a session — "fills up fast," and "LLM performance degrades as context fills." Anthropic's documentation describes this concretely as the "kitchen sink session" failure pattern: you start on one task, ask about something unrelated, come back to the first task, and the assistant's effective memory of what it's doing is now cluttered with irrelevant material. Its recommended fix is blunt — clear the context and start over with a sharper prompt rather than trying to push through a long, messy session. That's a structural risk specific to agentic, multi-turn vibe coding that a single one-shot prompt doesn't have.

Who vibe coding is actually for

Two very different audiences get lumped under the same word, and it's worth separating them. The first is people building something low-stakes — an internal tool, a personal project, a prototype to test an idea — where "it looks right and works when I click around" is a legitimate bar, because little is at risk if it breaks. The second is professional developers using agentic tools like Claude Code or Copilot's agent mode on real production systems, where the tools' own documentation pushes hard toward planning, testing, and review rather than pure vibes. Treating the second case like the first — skipping review because the first draft "feels" done — is where the practice's real-world failures tend to come from.

How to get started responsibly

If you want to try vibe coding without inheriting its worst habits, the tool makers' own documentation points to a few concrete practices:

• Separate planning from execution. Anthropic's guidance for Claude Code recommends an explore-then-plan-then-code sequence, so the assistant isn't jumping straight to a solution for a problem it hasn't fully scoped.
• Give the assistant a way to check its own work. A test suite, a build step, or even a screenshot comparison lets an agent verify its output instead of simply declaring a task done because it "looks" finished.
• Review before you ship, every time. GitHub's guidance is explicit that agent output should get the same secure-coding review as code written by a person, especially around authentication, data handling, and anything facing the public internet.
• Reset long sessions. If you've corrected the same mistake more than once or switched topics mid-session, start a fresh session rather than letting context pile up.
• Match the tool to the stakes. A hosted app builder aimed at non-coders is a reasonable choice for a weekend project; a production feature on a live product calls for a workflow where you — or a reviewer — actually read the diff.

What's next for vibe coding

Expect the vocabulary around this practice to keep splitting rather than staying as one word. Karpathy himself has already floated "agentic engineering" to describe the more deliberate, reviewed end of AI-assisted development, separate from the original, looser "give in to the vibes" sense. At the same time, the tools above keep adding guardrails — automated security scanning, approval gates, sandboxed execution, and structured planning modes — precisely because their makers' own documentation acknowledges that unreviewed AI-generated code is a real liability, not a hypothetical one. For anyone trying it for the first time, the practical takeaway is the same regardless of which word ends up sticking: natural language is a genuinely fast way to get a first draft of software, but someone — you, a teammate, or an automated check — still has to look at what came out before it goes anywhere that matters.

Written byTheo Park

Theo Park runs the AI desk at Pandromeda. He follows model launches from the frontier labs and the open-weight community, tracks the assistants and developer tools built on them, and explains what each release changes on pricing, capability and safety. His reporting leans on primary sources: model cards, technical reports, API documentation and the companies' own announcements.

More from Theo ParkAll AI coverage