Development

Vibe Coding Is Changing: What Developers Need to Know in 2026

Vibe coding changed how people build software with AI but blindly accepting generated code comes with serious risks. Discover what vibe coding really means, where it works, where it fails, and why developers are moving toward agentic engineering.

Toolbit AI - Team
7 min read
Vibe Coding Is Changing: What Developers Need to Know in 2026

The Short Version

Andrej Karpathy coined "vibe coding" in February 2025 to describe writing software by describing what you want and accepting the AI's output without reading it line by line. It exploded, Collins Dictionary named it Word of the Year, and by some counts nearly half of new code on GitHub is now AI-generated. Almost exactly a year later, Karpathy himself called it passé and rebranded to something more disciplined. Why he walked it back is the real answer to "when does this work."

Where the Term Came From

Karpathy posted the original idea on X on February 2, 2025, describing a style of coding where you stop tracking the code itself and just follow the "vibes" of what the AI produces. He scoped it specifically to throwaway weekend projects, not production software, a detail that got lost almost immediately once the term went viral.

The definition that actually stuck, per developer Simon Willison's widely cited distinction, comes down to one thing: whether you reviewed the code. If an AI wrote it but you read, tested, and understood every part, that's just AI-assisted development. The "vibe coding" label only fits when that review never happened.

How Big This Got

  • Over 80% of developers now use AI coding tools in their workflow, with roughly half of professional developers using them daily, according to the 2025 Stack Overflow Developer Survey
  • By some industry estimates, roughly 40–50% of new code on platforms like GitHub is now AI-generated or AI-assisted
  • A large share of people practicing vibe coding are not professional developers
  • The market around AI-assisted coding tools was estimated at roughly $4.7 billion in 2025 to 2026
Image

Where It Genuinely Works

  • Prototypes and throwaway projects, exactly what Karpathy originally scoped it for
  • Scoped, well-defined implementations, where a wrong output is easy to spot
  • Non-developers building simple internal tools, where the cost of a bug is low
  • Weekend projects and hackathons, where speed matters more than long-term maintainability

Where It Genuinely Breaks

  • 45% of AI-generated code contains OWASP Top 10 security vulnerabilities, per Veracode's research
  • Failure rates vary sharply by language: Java sits at roughly 72%, Python, the most reliable, still carries about 38%
  • A sample of 2.2 million AI-generated code snippets contained more than 440,000 references to hallucinated packages that don't actually exist
  • 96% of IT professionals say they don't fully trust AI-generated code
  • Only 28% of healthcare organizations and 34% of financial services companies use vibe coding at all, reflecting how much governance regulated industries still need before trusting it

The Productivity Story Actually Reversed

This is the part most coverage gets wrong by only citing half of it. In July 2025, METR's own randomized controlled trial, the gold-standard method also used in clinical drug trials, found something surprising: 16 experienced open-source developers using early-2025 AI tools on their own mature codebases were 19% slower with AI than without it, despite believing beforehand they'd be 24% faster.

Image

That finding got repeated everywhere as if it settled the question. It didn't. METR reran the same methodology on newer tools in February 2026 and found the opposite: the same research group now estimates roughly an 18% speedup for developers using late-2025 AI tools, a full reversal within a year, as both the tools and developers' ability to use them well improved.

The honest takeaway isn't "AI makes developers slower" or "AI makes developers faster." It's that the answer depends heavily on the tools' maturity, the developer's familiarity with them, and how well-scoped the task is, exactly the variables vibe coding's original definition ignored by design.

The Term Actually Means Three Different Things Now

Part of why arguments about vibe coding go in circles is that the term itself splintered. Depending on who's using it, "vibe coding" now refers to:

  • Karpathy's original sense: no review at all, reserved for prototypes and throwaway code
  • The everyday sense: any AI-assisted coding, even fully reviewed, tested code
  • The marketing sense: a selling point for no-code app builders aimed at non-developers

Most disagreements about whether vibe coding "works" are really just people using different definitions of the same two words.

The Tools People Actually Use

Two distinct categories have emerged. AI-powered code editors, Cursor, Windsurf, and Claude Code, sit inside a traditional coding environment and assist a developer who's still driving. Full-stack app generators, Bolt, Lovable, Replit, and v0, go further, building an entire working application from a prompt with little to no code written by hand. Most experienced teams end up using one of each: a generator for fast prototyping, then an AI-powered editor once the project moves toward something real.

Even Karpathy Moved On

In February 2026, Karpathy posted that vibe coding had become passé, replaced by what he called agentic engineering. He explained that coding through AI agents was fast becoming the standard way professionals build software, just with real oversight and scrutiny built back in, the opposite of the original "forget the code exists" framing. "Agentic" because you're mostly orchestrating AI agents rather than writing code directly, and "engineering" to reintroduce the discipline and review that got lost along the way.

That pivot lines up with the data above almost exactly: skipping review produces real, measurable security problems at scale, while staying genuinely in the loop is the mode holding up as adoption matures.

Signs You've Crossed a Line

A few concrete signals it's time to stop and actually read the code, whatever you started out calling it:

  • You can't explain what a function does without asking the AI again
  • The project now has real users, real data, or a real deadline attached to it
  • You've hit the same bug three times and just kept re-prompting instead of investigating
  • Someone else will need to maintain this after you

The vocabulary around this kept splintering as the practice matured. A quick glossary:

  • Agentic engineering: Karpathy's 2026 replacement term, AI agents doing most of the work with a human orchestrating and reviewing
  • Vibe slop: the low-quality output that results from unreviewed AI code shipped without any real oversight
  • Context debt: the accumulated confusion in a codebase where no single person, human or AI, fully understands how all the AI-generated pieces fit together
  • Vibe analytics and vibe lawyering: the same "describe it, accept it, skip the verification" pattern showing up in data analysis and legal drafting, not just code

If You're Not a Professional Developer

Most of the growth in this space has come from people who never learned to code traditionally, and the calculus is genuinely different for that group.

  • A working prototype that solves your own problem is a real win, even if the code underneath isn't pretty
  • The risk rises sharply the moment other people start depending on what you built, treat "just for me" and "other people use this" as two completely different risk levels
  • Learning to read even basic code, not write it, but read it, is the single highest-leverage skill for anyone building this way, it's what turns "hope it works" into "know it works"
Image

A Practical Framework

  • Weekend project or prototype with no real users? The original, loose definition is fine here, speed matters more than rigor
  • Anything touching real user data, production, or money? Treat AI-generated code like a junior developer's first draft, review it before it ships
  • Working in a regulated industry? Budget for governance now, the caution in healthcare and finance reflects real risk, not lagging technology
  • Not sure which mode you're in? If you haven't actually read and understood the code, you're vibe coding in the original sense, whether you meant to be or not

Adoption figures and statistics above are drawn from METR's own published research, Veracode's security data, and industry surveys as linked throughout. This is a fast-moving term with genuinely different usages across sources, treat specific numbers as directional rather than fixed.

Share this article

Related articles

Continue exploring similar guides and insights