What Is Vibe Coding? Building Software by Describing It
Vibe coding means building software by telling an AI what you want and judging the result by whether it runs. Where the term came from, the tools, a step-by-step workflow, prompts that work and the risks to check before anyone else uses your app.
Not long ago, building a small web app meant learning a framework or paying someone who had. Now plenty of people describe the app in a chat window, watch an AI write the code, paste back whatever error appears and repeat until it works. That's vibe coding: making software by telling an AI what you want and judging the result by whether it runs, not by reading the code. This guide explains what vibe coding is, where the term came from, the tools people use, a step-by-step workflow, prompts that make it work, and the risks that turn a weekend project into a data leak.
What vibe coding means (and where the term came from)
The phrase comes from Andrej Karpathy, an OpenAI co-founder and former head of AI at Tesla. On 2 February 2025 he posted on X about "a new kind of coding I call vibe coding", where you "fully give in to the vibes, embrace exponentials, and forget that the code even exists". He described talking to an AI code editor instead of typing, accepting every change without reading the diffs and pasting error messages back in with no comment, which usually fixed them. He also said it was "not too bad for throwaway weekend projects".
The term spread fast. Merriam-Webster listed it as "slang & trending" in March 2025, and Collins English Dictionary named it Word of the Year for 2025. Along the way the meaning stretched: some people use "vibe coding" for any programming with AI help, others keep Karpathy's narrower sense.
In the strict sense, three things define it:
- You describe outcomes in plain language: "add a login page", "make the chart use weekly totals", not instructions about functions and files.
- You don't read or fully understand the code: the AI writes it, edits it and fixes it.
- You judge by behaviour: if the app does what you wanted when you click around, you move on.
That last point is what makes it so accessible and so risky. Software can look right on screen and still be insecure, fragile or wrong with inputs you didn't try.
Vibe coding vs AI-assisted programming
Developer Simon Willison drew the most useful line in March 2025: if an AI wrote every line of your code but you reviewed, tested and understood all of it, that isn't vibe coding, it's using the AI as a typing assistant. The difference isn't the tool; it's whether a human takes responsibility for the code.
- Vibe coding: suited to prototypes, personal tools, one-off scripts, demos and learning. If it breaks, you're the only one affected.
- AI-assisted engineering: the same tools, but with reviews, tests, version control and someone who can explain every change. This is what you need for anything other people rely on, especially software that handles logins, payments or personal data.
Most people who vibe code well slide between the two. They vibe their way to a working prototype, then slow down and review the parts that matter before anyone else uses it. If you can code, our AI prompts for coding cover the review-everything end of that spectrum.
Tools people use for vibe coding
The tools fall into three rough groups, and they change quickly, so check current features and pricing before you commit:
- App builders in the browser: Lovable, Bolt.new, Replit and v0 turn a description into a running web app with hosting included. They're the easiest start for non-programmers, and the most likely to hide what's going on underneath.
- AI code editors: Cursor, Windsurf and GitHub Copilot's agent mode in VS Code edit a real project on your computer. You see every file, which makes reviewing possible even if you skip it.
- Terminal coding agents: Claude Code, OpenAI's Codex and Gemini CLI run in a terminal, read your project, run commands and make changes across many files. They're AI agents in the full sense: they act, not just suggest.
A plain chatbot also works for small things. Ask ChatGPT, Claude or Gemini for a single-file HTML page or a short Python script, copy it and run it. You'll hit the limits once a project needs several files, but it's a good way to see whether vibe coding suits you.
How to vibe code a small app, step by step
Take a realistic example: a page where your book club logs what each member is reading and rates it out of five. Here's a workflow that keeps the vibes but avoids the most common dead ends.
- Write a short spec first: who uses it, what they need to do, what it must never do and what "done" looks like. Ten lines are enough. Most frustrating vibe-coding sessions start with a one-sentence request that leaves the AI to guess everything else.
- Ask for a plan before code: have the AI propose the screens, the data it will store and the technology, and correct it before anything is built.
- Build the smallest version that works: one screen, fake data, no login. Get it running, then add features one at a time.
- Save a checkpoint after every working step: use git, or your builder's version history. When a change breaks things, going back is faster than arguing the AI out of a hole.
- Test like a user, then like a troublemaker: try empty fields, very long text, the back button and a second account that shouldn't see the first one's data.
- Review before you share: once other people will use it, ask for a security review (prompt below) and fix what it finds.
This is ordinary prompt chaining: a sequence of small, checkable requests instead of one huge one. Each step gives the AI less room to wander off.
Prompts that make vibe coding work
Good vibe-coding prompts sound like a brief to a contractor: the goal, the constraints and what counts as finished. The first one turns an idea into a plan you can check before any code exists:
When something breaks, the error message is your most useful input. Karpathy pasted errors "with no comment"; adding a little context gets better fixes:
The last instruction matters: models fixing one bug like to "improve" code nearby, which is how new bugs appear. Before you share the app, run a review:
Tools like Cursor and Claude Code also read a project rules file (such as CLAUDE.md or AGENTS.md) at the start of each session. Put your spec, tech choices and standing rules there ("never commit keys", "ask before deleting files") so you don't repeat them. Our system prompt generator is a quick way to draft one, and feeding the model the right documents at the right time is what context engineering is about.
When vibe coding goes wrong
The failures follow a pattern: the app worked on screen, and nobody checked what it did underneath.
- Exposed data: in May 2025, reports found that 170 of 1,645 web apps created with Lovable had a flaw that let anyone access personal information stored in them.
- Destructive agents: in July 2025, SaaStr founder Jason Lemkin reported that Replit's AI agent deleted his production database during an explicit code freeze, then misrepresented what had happened.
- Insecure by default: Veracode's research found that while models had become much better at writing code that works, the security of that code hadn't improved at the same rate.
- Invented packages: models sometimes recommend software libraries that don't exist. Attackers register those names with malicious code, a trick known as slopsquatting. It's the coding version of AI hallucinations.
- Code nobody can maintain: after a few weeks of accepted changes, a project can reach a size where neither you nor the AI can change one thing without breaking another.
There's also a newer risk for agents that browse or read files: hidden instructions in a web page or a downloaded library can steer them, which is prompt injection with access to your terminal.
How to vibe code more safely
You don't need to become a programmer to avoid the worst outcomes. Most of the protection is in habits:
- Keep secrets out of the code: API keys and passwords belong in environment variables or your platform's secrets settings, never in a file the browser downloads. Ask the AI to show you where each key lives.
- Use test data until the end: build with fake names and addresses. Real personal data should only arrive after a security review.
- Limit what agents can do: work in a copy or a separate folder, keep production databases out of reach and turn on approval for commands that delete, deploy or install.
- Back up before every big change: git commits or the builder's checkpoints. Restoring takes seconds; rebuilding from memory takes days.
- Get a human to look before launch: if the app takes payments, stores health or financial data or serves the public, pay a developer for an hour of review. It costs less than the incident.
What vibe coding can't do
- It can't take responsibility: if the app leaks data or loses money, the person who shipped it is accountable, not the model.
- It doesn't scale cleanly: it's at its best on small, self-contained projects. Large codebases with many users, integrations and years of history still need people who understand them.
- It isn't always faster: in a 2025 randomised trial by METR, experienced open-source developers working on their own projects were 19% slower with AI tools, while believing they'd been faster.
- It can't know what you didn't say: the AI fills gaps with plausible guesses. Unstated requirements, such as privacy rules, accessibility or what happens when two people edit at once, are usually missing.
- It doesn't teach you much by default: accepting changes without reading them builds apps, not skills. If you want to learn, ask the AI to explain each change and try small edits yourself.
Used for what it's good at, vibe coding is remarkable: a working prototype in an afternoon, a personal tool that would never have been worth hiring someone for, a demo that settles an argument. Treat the result as a prototype until someone has checked what's under the bonnet. If you write for Claude or Claude Code, our Claude prompt generator helps you turn a rough idea into a structured spec.
