"I asked it to build a button. It built a website. I do not know what the website does."— Office Man
What is vibe coding?
Vibe coding means describing software in plain language and having an AI write the code — without you needing to understand what the code does. Andrej Karpathy coined the term in 2025. The capability is real: current AI tools can generate working scripts, small web tools, automations, and data-processing utilities from plain-language descriptions with surprising reliability. For anyone who previously had no access to software creation, this is a genuine change. Previously the options were: learn to code, pay a developer, or go without. Now there is a fourth option.
Where it goes wrong
All software breaks eventually. When a vibe-coded tool breaks and you cannot read the code, your options are: ask the AI to diagnose it from a description (which works if the problem is describable), or find someone technical. Neither may be available. Beyond breakage: AI-generated code can introduce security vulnerabilities — not from malice, but from generating technically working code that does not follow current security practice. For anything handling personal data, financial information, or access to shared systems, code that has not been reviewed by someone who understands security is a risk. And code that works on 100 rows may fail on 100,000.
The confidence problem
AI coding tools produce code confidently whether they are certain or guessing. The output looks the same either way. A vibe-coded tool can appear to work correctly while containing subtle errors that only surface under specific conditions. For a personal script only you use, this is an acceptable risk. For a tool relied upon by a team, used in a financial process, or connected to shared data, it is not. The first working version is a prototype. The reviewed version is the tool you rely on.
What to do
Use vibe coding freely for throwaway and personal tools: one-off data processing, personal automations, small scripts. These are ideal. Do not use vibe-coded output in production — anything relied upon by more than one person, connected to shared systems, or involved in anything with financial or compliance implications — without a developer reviewing it. If you are building these tools at work, make sure someone technical knows they exist. And treat "it worked once" as the beginning, not the end. Something that works once may not work next month.