Vibe coding is the practice of letting an AI model generate the code, the developer pastes it in, runs it, ships it, and hopes. Andrej Karpathy named it in early 2025. By Q1 2026 it is no longer a curiosity. It is how a meaningful slice of greenfield software is being written, and the consequences are starting to land.
GitHub Copilot has 1.8 million paying seats. Cursor hit a $100M annual run rate in late 2025. Claude Code, the agentic coding tool, went GA in November 2025 and is now standard equipment in half the YC companies I have talked to in 2026. Volume of code being written by people who did not write it has never been higher. Volume of code being shipped by people who cannot debug it has never been higher either.
What vibe coding is actually doing
Most of the vibe coded software in 2026 is not the kind that lives for a long time. It is prototypes, internal tools, weekend hacks, demo apps, the kind of thing that gets shown to a stakeholder on a Thursday and rewritten on a Monday. Model writes the code, developer runs it, model writes the next version, developer runs that. Cycle is fast. Software is throwaway. Cost of getting it wrong is low. None of this is a problem. All of it is a problem when the same pattern gets applied to software that is supposed to live for a year.
Where it is breaking
Breaks are showing up in three places. Vibe coded software has the same kind of security flaws the model was trained on, which means it has the same kind of security flaws every codebase had in 2019. Developers who shipped vibe coded software cannot necessarily fix it three months later, because the mental model was never built. Junior developers who spent 2025 vibe coding instead of learning the fundamentals are the ones hitting a wall in 2026. None of these are reasons to stop using the tools. All of them are reasons to use them differently.
How to actually do it well
Patterns that work are not complicated. Vibe code the throwaway and write the long lived by hand. The prototype, the demo, the weekend hack are all fine to vibe. The production system and the security critical code are not. Use the tools to learn rather than skip the learning, which means reading the code the model writes and understanding why it works. Keep the architectural decisions in the developer’s head, not the model’s, because the model is good at implementing and not good at deciding. None of this is anti AI. All of it is anti vibe coding the wrong things.
The bottom line
Vibe coding is a working pattern for the kind of code that does not need to last. Developers who use it for prototypes and not for production, who use it to learn and not to skip learning, are the ones who come out the other side with a craft.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
