Vibe Coding Explained: What It Means for Your Business

Vibe coding is building software by describing what you want to an AI in plain language, letting the AI write the code, and judging mainly whether the result works rather than how the code looks. For prototypes, small internal tools and testing an idea, it is remarkably fast. For software that handles customer data, processes payments or connects to your ERP, it is a risk unless an engineer who understands the code reviews and owns it.

The short version:

Andrej Karpathy coined the term in February 2025, and Collins named it Word of the Year 2025.

In a controlled study by METR, experienced developers using AI tools were 19% slower, while believing they were faster.

Veracode found that 45% of AI-generated code samples failed security tests.

Vibe coding is excellent for prototypes. Production software needs review, tests and someone accountable for the architecture.

What is vibe coding, actually?

The term was introduced by Andrej Karpathy, former Director of AI at Tesla and one of OpenAI's early engineers. In February 2025 he posted on X: "There's a new kind of coding I call 'vibe coding', where you fully give in to the vibes, embrace exponentials, and forget that the code even exists."

That last part is the essence. In vibe coding you do not really read the code. You describe what you want, the AI builds it, you click through it, and when something breaks you paste the error back into the chat. The BBC described it as making an app or website by describing it to AI rather than writing the code by hand. Collins Dictionary named "vibe coding" its Word of the Year 2025.

The tools come in several flavors: chat assistants like ChatGPT, Claude and Gemini, app builders that generate a complete web app with a database in one go, and coding agents that work inside an existing codebase.

Vibe coding vs AI-assisted engineering

It helps to separate two things:

	Vibe coding	AI-assisted engineering
Who writes the code	AI	AI and engineer together
Is the code read	Barely	Yes, every change is reviewed
Testing	Clicking through manually	Automated tests
Architecture	Emerges by accident	Deliberately designed
Good for	Prototypes, demos, personal tools	Production software with customer data

Professional teams use AI heavily, Airflows included. The difference is not the tool, but who is accountable for what goes live.

What does research say about speed?

The promise is that AI makes programming many times faster. The best controlled study so far paints a more nuanced picture.

METR, an independent research organization, had experienced open source developers complete real tasks in their own projects in the first half of 2025, randomly assigned with or without AI tools. With AI, they took 19% longer on average. The striking part: the developers themselves, and outside experts, expected a speedup.

METR then started a follow-up study. Early estimates point toward a speedup, around 18% faster for returning participants. But METR itself calls that data unreliable because of selection effects and is redesigning the experiment. The honest conclusion: it is not proven that AI makes experienced developers faster in complex existing codebases, and people overestimate their own gains.

Where AI clearly saves time: small new projects without history, boilerplate code, and people who could not have built anything at all without it.

The risks: security and reliability

Insecure code

Veracode tested more than 100 AI models on coding tasks. In 45% of cases the generated code contained vulnerabilities from the OWASP Top 10, the standard list of the most common web application security flaws. Results varied by language: Java 72%, C# 45%, JavaScript 43% and Python 38%. For cross-site scripting, the models got it wrong 86% of the time.

If nobody reads the code, nobody sees these flaws. An app that works perfectly when you click through it can at the same time expose every customer record.

Missing access control

A recurring pattern in quickly built apps is a database accessed directly from the browser without proper rules about who may read what. CVE-2025-48757 concerned apps built with Lovable and connected to Supabase without proper access control, which exposed user data.

An agent with too much power

In July 2025, Replit's AI agent deleted the live database of SaaStr founder Jason Lemkin during an explicit "code and action freeze". According to SaaStr, it held records of 1,206 executives and more than 1,196 companies. The agent itself wrote: "This was a catastrophic failure on my part." Replit announced new safeguards.

The lesson is not that AI agents are useless, but that an agent should never have more permissions than it needs. Development must be separated from production, and destructive actions should require human confirmation.

Where vibe coding works for business

This is not an argument against vibe coding. It is a powerful tool when you use it in the right place:

Prototypes and clickable demos. Show an idea to colleagues or customers within an afternoon, before spending a budget on it.
Personal tools. A script that reshapes a spreadsheet export, a small dashboard for yourself, with no customer data and no connection to production systems.
Specifying by building. A working prototype says more than a twenty-page document. It is excellent input for an engineering team.
Learning. Understanding what software can do and what it takes, without learning to code first.

Can anyone vibe code? Yes, and that is its strength. Can anyone ship production software by vibe coding? No, and that is the trap.

When you need an engineer

A simple rule of thumb: as soon as one of these is true, someone needs to read the code and own the architecture.

The app processes personal or customer data.
It connects to your accounting system, ERP or CRM and can change data there.
Money flows through it: payments, invoices, pricing.
Multiple people or customers log in with different permissions.
The business depends on it every day.

Then come the things vibe coding skips: server-side access control, automated tests, logging, backups, separate development and production environments, and maintenance as libraries and APIs change. What that means in money is covered in custom software development cost. If you want to know why so many AI initiatives get stuck between demo and production, read why AI projects fail.

From vibe-coded prototype to production

Already built a prototype with an AI tool? That work is not wasted. A sensible path:

Use the prototype as the specification. It shows exactly which screens and steps you mean.
Have the code reviewed. Sometimes parts are reusable. Often it is faster and safer to rebuild the core on a deliberate data model.
Design permissions and integrations on purpose. Who can do what, which system is the source of truth, what happens on errors.
Add tests and monitoring before real users arrive.
Deploy it in your own environment, with the code in a repository under your name.

At Airflows we use AI coding tools every day to build faster, but every line that goes to production is reviewed and tested, and the code belongs to the client.

Frequently asked questions

What is vibe coding actually?

Vibe coding is making software by describing what you want to an AI in plain language, without really reading the generated code. You mainly judge whether the result works. Andrej Karpathy introduced the term in February 2025.

Is vibe coding good or bad?

It is good for prototypes, demos and personal tools, because you get something working very quickly. It is risky for production software with customer data or integrations, because research shows AI-generated code often contains security flaws. It depends on what you use it for.

Can anyone do vibe coding?

Yes, you do not need programming skills to build a working prototype. You do need that knowledge to judge whether an app is secure, reliable and maintainable. That is the difference between a demo and a system your business runs on.

Can ChatGPT be used for vibe coding?

Yes. ChatGPT, Claude and Gemini can all write code from a description, and dedicated tools can scaffold a complete web app. For business use, watch which data you put into the tool and the terms of the account you use.

Will AI make software engineers obsolete?

No. METR's research showed experienced developers did not automatically get faster with AI, and AI-generated code needs security review. The work is shifting though: less typing, more design, review and testing.

Next steps

Have an idea or a prototype that runs on your laptop and want to know what it takes to get it safely into production? Start with the free AI scan, or see how we build custom software and AI systems where speed and control go together.

Get started today