Is Vibe Coding Bad? What the Evidence Says in 2026

What Vibe Coding Actually Means

Andrej Karpathy named it in a post on X on 2 February 2025. He described a way of building where you accept every change the model suggests and "forget that the code even exists." In the same post he said he no longer read the diffs, pasted error messages back in without comment, and thought the approach was fine for throwaway weekend projects.

So in Karpathy's original sense, vibe coding means building with code you have not read. Most of what goes wrong follows from that part.

The term caught on. Collins Dictionary named vibe coding its Word of the Year for 2025, describing it as using AI, prompted in plain language, to write code. Most professional developers were not doing it, though. In Stack Overflow's 2025 Developer Survey, 72% said vibe coding was not part of their professional work, and another 5% said so emphatically.

Vibe Coding Pros and Cons: The Evidence

Sources: Karpathy, Anthropic, Veracode, GitClear, METR's 2025 study and 2026 update. Each one is explained below.

Where Vibe Coding Works

• Prototypes and demos. Karpathy built MenuGen, an app that turns a photo of a menu into pictures of the dishes, at a vibe coding hackathon. In his write-up he says the first local version was quick to build, with Cursor and Claude writing all the React frontend components.
• Personal and internal tools. An app only you or your team use, kept off the public internet, puts less at risk when something breaks.
• Learning, if you ask why. In a randomised trial Anthropic published in January 2026, 52 mostly junior engineers learned a Python library new to them. Those using AI averaged 50% on a quiz about it, against 67% for those coding by hand, and they were not significantly faster. Participants who used AI to ask for explanations or conceptual answers tended to score higher, though the authors say this does not prove cause.

Speed for experienced developers is less clear than it feels. In METR's 2025 trial, 16 experienced open-source developers took 19% longer on 246 real issues when AI was allowed, yet believed afterwards that it had sped them up by 20%. METR's February 2026 update, with 57 developers and more than 800 tasks, called its new data an unreliable signal. The authors think developers are likely faster now than in early 2025, but say the data is only weak evidence. Neither study tested vibe coding as such.

Where It Goes Wrong: Security

Code that runs is not the same as code that is safe, and only the first has improved. Veracode has tested more than 100 AI models over four years. Its 2026 report, published on 28 July 2026, says models now write syntactically correct code nearly every time, but the average security pass rate is 56%, against 55% in the first report. Roughly 44% of tasks produced a risky vulnerability. Cross-site scripting passed only 15% of the time, and the best model, GPT-5.5, reached 68%. Our breakdown of the Veracode report shows what that looks like in a Next.js app.

Our own scans find the same problems in real projects. Of 963 codebases VibeDoctor scanned between 31 July and 14 October 2026, 654 (67.9%) had at least one dependency with a known CVE, and 364 (37.8%) had at least one string that looked like a secret, a count that includes test fixtures and placeholder values. We cannot tell how much of each codebase an AI wrote, so read these as what turns up in real repositories, not as a rate for vibe coding. The 2026 vibe coding security report has more.

Incidents show the cost. In April 2026, The Next Web reported a broken object-level authorisation flaw in Lovable's own API. Anyone with a free account could reach other users' profiles, public projects, source code and database credentials in as few as five API calls, and the researcher found hardcoded Supabase credentials in project source code. The flaw had been open for 48 days at the time of reporting, and Lovable said it had not suffered a data breach. Our write-up of the Lovable BOLA flaw explains the bug and the fix.

Where It Goes Wrong: Code Nobody Understands

The quieter cost is maintenance. Accept code without reading it and you own a system you cannot explain, which you discover when something breaks. We call this comprehension debt. Karpathy's original post admitted it: the code grew beyond what he usually understood, and when the model could not fix a bug he worked around it.

He hit a real example on MenuGen. He caught Claude matching Stripe payments to user credits by email address. The email someone types at Stripe checkout may not be the one on their Google sign-in, so a buyer could pay and never get the credits. When he pointed it out, Claude rewrote it to pass unique user IDs in the request metadata. The fix was easy. Noticing it meant reading the code.

// BAD: credits go to whichever account matches the email typed at checkout
const session = await stripe.checkout.sessions.create({
  mode: 'payment',
  line_items: [{ price: CREDITS_PRICE_ID, quantity: 1 }],
  success_url: `${APP_URL}/thanks`,
});

// in the checkout.session.completed webhook
const buyer = await db.user.findUnique({ where: { email: session.customer_details?.email } });

// GOOD: the signed-in user's ID travels with the payment
const session = await stripe.checkout.sessions.create({
  mode: 'payment',
  line_items: [{ price: CREDITS_PRICE_ID, quantity: 1 }],
  success_url: `${APP_URL}/thanks`,
  client_reference_id: user.id,
});

// in the checkout.session.completed webhook
const buyer = await db.user.findUnique({ where: { id: session.client_reference_id } });

Stripe's API reference describes client_reference_id as a way to match the session to your own records, and says customers are asked for an email address when you do not supply one.

Developers report the same friction. In Stack Overflow's 2025 survey, the top frustration with AI tools, named by 66%, was solutions that are "almost right, but not quite", and 45.2% said debugging AI-generated code takes more time. GitClear's 2026 report on 623 million code changes found moved code, a sign of refactoring, fell from 21% of changed lines in 2022 to 3.8% so far in 2026, while copy/pasted code rose from 9.4% to 15.7%.

Is Vibe Coding the Future, or Is It Dead?

We will not predict. Here is what the sources above say.

• Karpathy has moved on from the term. In a post on 4 February 2026, he called the original a throwaway tweet and said that models were weak enough back then that vibe coding was mostly for "fun throwaway projects, demos and explorations." Professionals, he wrote, now increasingly build with AI agents as a default workflow, but with more oversight and scrutiny. His current favourite name for that is agentic engineering.
• He was cautious even in 2025. His MenuGen write-up concluded that vibe coding full web apps was "not a good idea for anything of actual importance", while seeing early promise.
• Most professionals were not vibe coding. In the 2025 Stack Overflow survey, 84% used or planned to use AI tools, yet over three quarters said vibe coding was not part of their work.
• The productivity data is unsettled. METR's 2026 update could not show a clear speed-up or slow-down.

So whether vibe coding is dead depends on the definition. Accepting code unread for anything important has few defenders here, including the person who named it. Building with agents and reviewing their work is what Karpathy says professionals do now.

How to Keep the Upside

1. Vibe code the prototype, not the launch. Use it freely to test an idea. Before real users or real money arrive, start reading what the agent wrote.
2. Read the code that touches money, logins and other people's data. Karpathy's Stripe bug and Lovable's access flaw both sat in this kind of code. Check that every record lookup is limited to the signed-in user.
3. Ask the agent to explain, not just to write. In Anthropic's trial, learners who asked for explanations tended to do better.
4. Keep secrets out of the code. Move keys to server-only environment variables and rotate any that were ever committed.
5. Check before you ship, and after big changes. Work through our vibe coding security checklist and the 12 rules for shipping AI-generated code.

Tools like VibeDoctor's Vibe Check (vibedoctor.io) automatically scan your repository and live site with 149+ checks, and flag leaked secrets, dependency CVEs, imports of packages that do not exist and missing security headers, with specific file paths and line numbers. Your agent can call it over MCP from Claude Code, Cursor or Codex. Free to sign up.

FAQ