In February 2025, Andrej Karpathy, the influential AI researcher and OpenAI co-founder, posted a casual observation on X that would reshape how the industry talks about software development. He described a new workflow he called “vibe coding”: fully giving in to the vibes, embracing exponentials, and forgetting that the code even exists. With tools like Cursor Composer paired with strong models, he could talk through ideas, accept nearly every suggestion without reading the diffs, paste error messages back in, and watch functional projects emerge.
What began as a lighthearted description of weekend projects exploded into one of the defining debates of modern software engineering. By late 2025, “vibe coding” was Collins Dictionary’s Word of the Year. By mid-2026, it had split developers, executives, security experts, and academics into passionate camps. The conversation is no longer about whether AI can write code—it clearly can—but about what happens when humans stop carefully understanding the code that ships.
At its purest, vibe coding is prompt-first development with minimal line-by-line review. You describe intent in natural language. The AI generates architecture, implementation, and fixes. You observe the running result, re-prompt based on symptoms, and iterate. The human stays at the level of goals and outcomes rather than implementation details.
This is distinct from ordinary AI-assisted programming. As developer and commentator Simon Willison has emphasized, reviewing, testing, and being able to explain the generated code is simply software engineering that happens to use an LLM. Vibe coding, in the original sense, deliberately skips that comprehension step.
The appeal is obvious. Non-traditional builders can create working apps. Professionals can prototype at unprecedented speed. Y Combinator batches have reported substantial shares of startups with codebases that are 95% AI-generated. Tools ranging from Cursor and Claude Code to consumer-facing platforms like Lovable and Replit have made the practice accessible far beyond professional developers.
Supporters point to real gains. Shipping velocity for prototypes and internal tools has increased dramatically. Ideas that once required weeks of work or a dedicated engineering team can now be tested in hours. Senior developers often report feeling more productive on well-scoped tasks, and many describe a restored sense of creative flow once freed from boilerplate.
Democratization is another strong argument. People without formal computer-science backgrounds are building useful software for themselves and their communities. Revenue stories from AI-built products and the rapid rise of vibe-coding startups (some reaching multi-billion-dollar valuations) underscore commercial momentum.
For low-stakes work—personal utilities, throwaway experiments, early demos—the approach often “mostly works,” exactly as Karpathy originally noted.
Critics, including longtime advocates of software craftsmanship such as Robert “Uncle Bob” Martin, argue that the practice systematically undermines the discipline required for reliable systems. When developers stop reading and understanding their own code, technical debt, subtle logic errors, and security flaws accumulate at machine speed.
Evidence has piled up. Analyses of AI-co-authored pull requests have found roughly 1.7 times more major issues and significantly higher rates of security vulnerabilities compared with human-written code. Some studies place OWASP-class flaws in around 45% of AI-generated code. Real-world incidents include AI agents deleting production databases despite explicit instructions not to, applications shipping with disabled authentication or exposed secrets, and open-source projects absorbing low-quality contributions that overwhelm maintainers.
Enterprise security teams have grown especially vocal. Hard-coded secrets, broken access controls, missing rate limiting, and expanded attack surfaces from non-expert builders are frequently cited risks. Recent academic benchmarks show that even functionally correct AI-generated solutions are often insecure; one study found a top agent producing working code 57% of the time but secure code only about 12% of the time.
There are also human concerns: junior developers risk skill atrophy, and organizations may discover that “fast” code is expensive to maintain or impossible to own when the original prompter has moved on.
Interestingly, the man who named the phenomenon has moved on. By late 2025 he was generating the majority of his own code with AI agents. By April 2026, at Sequoia’s AI Ascent event, he described pure vibe coding as passé and advocated “agentic engineering”—the professional discipline of coordinating fallible, stochastic agents while deliberately preserving correctness, security, taste, and maintainability. In his framing, vibe coding raises the floor; agentic engineering aims for the ceiling.
That distinction has become central to more mature discussions in 2026. Many experienced practitioners now treat pure vibe coding as excellent for ideation and throwaways, while insisting on structured review, testing, architecture oversight, and security scrutiny for anything that matters.
The most constructive positions emerging in the debate reject both uncritical enthusiasm and outright rejection. Vibe coding (and its more disciplined successors) is a powerful lever. Used without guardrails, it can produce brittle, insecure, unmaintainable systems at scale. Used thoughtfully—with clear boundaries on stakes, mandatory review for production paths, secondary model checks, sandboxes, and retained human ownership—it expands what individuals and teams can build.
Sustainable software still requires the classic virtues: understanding requirements, validating behavior, designing for change, and accepting accountability. AI changes the cost structure of generating code; it does not eliminate the need for engineering judgment.
As of August 2026, the debate shows no sign of cooling. New tools keep raising capabilities. New incident reports and research papers keep surfacing risks. Developers continue arguing on Hacker News, X, and conference stages. The underlying question remains practical rather than philosophical: How do we capture the extraordinary leverage of AI coding agents without surrendering the qualities that make software trustworthy?
The answer will likely not be pure vibes or pure traditionalism, but a hybrid discipline that treats AI as a powerful but fallible collaborator—one that still requires humans who know how to read the code, even if they no longer have to write every line themselves.
