# What is vibe coding? Andrej Karpathy named it in February 2025, Collins made it Word of the Year, and by 2026 even he had a new name for the serious version. Published 2026-10-05 by Richard Kaminsky and Mitchell Lipyansky, the co-founders of Poly. Canonical: https://usepoly.co/what-is-vibe-coding Poly is a multiplayer AI coding workspace: a shared room where your team works with one AI agent, together. Free to start: https://usepoly.co/ **Vibe coding is building software by describing what you want to an AI and accepting the code it writes without reading it: you judge the result by whether it works, not by the code. Andrej Karpathy coined the term on February 2, 2025, for a way of coding where you "fully give in to the vibes" and forget the code exists, and Collins Dictionary named it Word of the Year for 2025. It works well for prototypes, personal tools and demos. For software other people depend on, studies keep finding security flaws in AI-written code, and by 2026 Karpathy himself was calling the reviewed, professional version agentic engineering.** ## Key takeaways - Coined by Andrej Karpathy on February 2, 2025; Collins's Word of the Year for 2025; added to Merriam-Webster in September 2026. - Simon Willison's test: if you review, test and understand the code, it isn't vibe coding but ordinary AI-assisted programming. - Veracode's 2026 report found AI-written code passing its security checks about 56% of the time, unchanged for a year. - The professional version has a new name: agentic engineering. ## Where does the term come from? Karpathy, an OpenAI co-founder and former head of AI at Tesla, described the idea in a post on X on February 2, 2025: a new kind of coding where you let the AI write everything and stop paying attention to the code. He credited Cursor's Composer running Claude Sonnet for making it possible. The name says how it works: you go by the vibes, whether the app feels right and does what you wanted, rather than by reading what the AI wrote. A year later, Karpathy called the original a throwaway post, said vibe coding in 2025 had mostly been good for fun projects and demos, and proposed **agentic engineering** as the name for the professional practice: you orchestrate agents rather than write code yourself, and doing it well takes real skill ([The New Stack](https://thenewstack.io/vibe-coding-is-passe/), February 2026). ## Is vibe coding a real word now? Yes. [Collins Dictionary](https://blog.collinsdictionary.com/language-lovers/collins-word-of-the-year-2025-ai-meets-authenticity-as-society-shifts/) named it Word of the Year for 2025 on November 6, 2025, defining it as using AI, prompted in natural language, to write code. Merriam-Webster added it as a dictionary entry in its September 2026 update. ## How is vibe coding different from AI-assisted programming? By whether anyone reads the code. Simon Willison drew the line in March 2025: vibe coding is building software with an AI without reviewing what it writes, and if you review, test and understand the code, you're doing ordinary AI-assisted programming ([Simon Willison](https://simonwillison.net/2025/Mar/19/vibe-coding/)). In 2026 the reviewed version is increasingly called agentic engineering, and OpenAI ran an event on "vibe engineering" with Codex. At Anthropic's Code with Claude conference in May 2025, a talk on vibe coding in production made a similar point: you can forget about the code, but not about the product. ## Where does vibe coding work, and where does it break? It works for things you could throw away: prototypes, personal tools, demos, internal one-offs and learning. It breaks on software that holds other people's data or money, because nobody has checked what the AI built. The record so far: - **AI-written code fails security checks often.** Veracode's 2025 report tested more than 100 models on 80 tasks and found an OWASP Top 10 flaw in 45% of them; its 2026 report put the average pass rate at about 56%, flat for a year, with models built for coding no safer than general ones ([Veracode](https://www.veracode.com/news/llms-are-getting-smarter-but-not-safer-veracode-2026-genai-code-security-report-finds-ai-generated-code-security-has-stalled-at-56%25-pass-rate/)). - **Missing database rules leak data.** In 2025 a researcher scanned 1,645 apps built with Lovable and found 170 exposing personal data, keys or financial records, because row-level security wasn't set up (CVE-2025-48757; Lovable says securing each app's data is the customer's job). In April 2026, a separate flaw let free accounts read other users' projects, which Lovable first denied and then acknowledged ([The Register](https://www.theregister.com/2026/04/20/lovable_denies_data_leak/)). - **Agents can delete things.** In July 2025 Replit's agent deleted a founder's production database during a code freeze; Replit then separated development and production databases. ## How do you vibe code safely? - **Keep it to things you can throw away**, or have someone who can read code review it before real users or real data touch it. - **Keep secrets out of prompts and code;** use the platform's environment variables. - **Turn on your database's access rules,** such as row-level security, before you store anyone's data. - **Keep development and production apart,** so a bad turn can't reach live data. - **Ask for a plan first, in plain language,** and use a mode that asks before each change when you can't judge the code. - **Get a second opinion,** from a person or a model from another lab: [cross-model code review](/cross-model-code-review). ## What tools do people use for vibe coding? - **App builders** that turn a chat into a running app: Lovable, Bolt, Replit, v0 and Google AI Studio's Build mode. [Lovable alternatives for teams](/lovable-alternatives-for-teams) compares them. - **Coding agents** for people who still look at the code sometimes: Cursor, Claude Code and Codex. [Claude Code vs Codex](/claude-code-vs-codex). - **Free options** are in [the best free AI for coding](/best-free-ai-for-coding), and for beginners, [Claude Code for non-technical people](/claude-code-for-non-technical-people). ## Can you vibe code with friends? Usually vibe coding is one person and one AI. In Poly (usepoly.co), a group builds in one room with one AI, and the room sits between vibes and review: in the modes that ask, each proposed change appears as a plain-language card that anyone can approve or reject, any turn can be undone in one click, and the app runs in a live preview everyone sees. Free to start. [What is Poly?](/what-is-poly) ## Common questions **Who coined the term vibe coding?** Andrej Karpathy, a co-founder of OpenAI and former head of AI at Tesla, in a post on X on February 2, 2025. **Why is it called vibe coding?** Because you go by the feel of the result, whether the app works and looks right, instead of reading the code the AI wrote. **Is vibe coding safe?** For throwaway projects, mostly. For apps that hold other people's data, have the code reviewed: Veracode's 2026 report found AI-written code passing its security checks only about 56% of the time. **Is vibe coding the same as coding with AI?** No. Vibe coding means not reviewing the code. If you review, test and understand what the AI writes, it's AI-assisted programming, which in 2026 is often called agentic engineering. **What is agentic engineering?** Andrej Karpathy's 2026 name for the professional version of vibe coding: directing AI agents to write the code, with the skill and oversight to make sure it's right. More guides: https://usepoly.co/guides · Security: https://usepoly.co/security · Pricing: https://usepoly.co/pricing