What is vibe coding? Where it works and where it breaks

01Where the term came from

The term comes from Andrej Karpathy, a well-known AI researcher. Karpathy was part of the team that started OpenAI, the company behind ChatGPT, and later led AI at Tesla. On 2 February 2025, Karpathy posted on X about a new kind of coding called vibe coding. The idea: go with the flow and "forget that the code even exists".

The post described building with Cursor and one of Anthropic's Claude models, speaking requests out loud, accepting every change the AI made without reading it, running the result and pasting errors back in. It mostly worked. The post also said this was good enough for weekend projects you don't mind throwing away.

In November 2025, Collins English Dictionary named "vibe coding" its Word of the Year.

In February 2026, a year on, Karpathy wrote that vibe coding had mostly been for fun experiments and demos. More and more professionals now build with AI agents (AI tools that make the changes themselves), the post said, but they check the work more closely. Karpathy suggested calling that careful version agentic engineering.

02What vibe coding looks like in practice

Many people now use the term loosely for any building with AI, and Collins's definition is that broad. The original meaning is narrower, and it's the useful one: nobody reads the code.

In practice it goes like this:

1. You type a wish: "Build me a booking app for my salon."
2. The AI writes the code, often across many files, in minutes.
3. You look at the result in the browser, not at the code.
4. Something's wrong, so you paste the error back in and say "fix it".
5. You accept every change and keep going until it looks right.

The programmer Simon Willison drew the line clearly in 2025. If you review what the AI wrote, test it properly and could explain how it works to someone else, that isn't vibe coding. It's building software with AI help, and the tools can be exactly the same.

The AI writes the code either way. The difference is whether anyone checks it.

03What it's good for

Vibe coding is useful when nothing serious depends on the result:

• Trying an idea. A rough version of a page or a tool, to see whether it's worth building properly.
• Showing what you mean. A quick mock-up to show a client the layout you have in mind.
• Tools only you use. A small calculator for your own prices, or a page that tidies your notes.
• Learning. Watching what AI can build, then asking it to explain how it works.

The test is simple: if it breaks tomorrow, does anyone lose money, data or trust? If the answer is no, vibe coding is fine.

04Where it goes wrong

The trouble starts when a vibe-coded project meets real customers:

• Security holes. Code can work and still leave doors open: a database anyone can read, or a form that accepts anything a bot sends it. In May 2025, the news site Semafor reported on a check of 1,645 apps made with Lovable, a popular AI app builder. Researchers found 170 that let anyone see their users' details, including names, email addresses and secret keys. The databases behind them hadn't been set up to keep that information private.
• Leaked keys. A secret key works like a password that lets your site use another service, such as the one that sends its emails. Keys end up in the code, on GitHub, in AI chats, or in a screenshot shared on WhatsApp. Automated programs search public code for keys all day, and a leaked key can be found and used within minutes. If it's for a paid service, the bill is yours.
• Features that break and nobody can fix. The code grows past what anyone understands. Each fix breaks something else, and the AI starts going in circles. With no saved versions, there's no way back to the last time it worked.
• No real back end. The back end is the hidden part that saves orders, sends emails and checks who's logged in. A vibe-coded site can look finished while the order form saves nothing, or the owner's login only hides a page instead of locking it. The AI may still tell you it all works.
• AI with too much power. In July 2025, a tech founder testing Replit's AI coding agent reported that it had deleted the founder's live database, despite being told not to change anything without permission. The data was recovered, and Replit's chief executive called it unacceptable.
• Client sites nobody can maintain. Three months after launch, a client in Kumasi wants new prices on the menu. There's no brief, no record of what changed, nobody who understands the code, and the accounts sit in someone's personal email. Every small change becomes a risk. Our guide How to start a web design business in Ghana covers handovers and monthly care.

05Vibe coding vs building properly with AI

Building properly with AI uses the same tools, and the AI still writes most of the code. The difference is five habits:

1. A written brief first. Before you open the editor, write down who the site is for, what it must do, its pages and the real content: names, prices, opening hours. Write "TBD" for anything you don't know yet, so the AI never invents a price or a phone number.
2. Small steps. One prompt, one change. When something breaks, you know exactly which change broke it.
3. Check and test what the AI wrote. Read the list of changes it made, and ask it to explain anything unclear. Open the page on a phone and a laptop and click every button. When there's a bug, ask for the cause before you ask for a fix.
4. Version control. Save a version with Git after every change that works, and push it to GitHub so it's backed up online. If the next change goes wrong, you can go back in seconds.
5. Secrets out of code and chats. Keys live in a private settings file on your laptop and in your hosting dashboard, never in the code, an AI chat or a screenshot. If one ever leaks, replace it with a new key straight away.

None of this means writing code from scratch. It does mean learning to read a little of it. Our guide Do you need to know coding to build a website in 2026? explains how much.

06How to start safely

Whether you want to vibe code for fun or build sites for clients, start where a mistake can't hurt anyone:

• Pick a low-stakes first project. A one-page site about yourself, or a practice site for a made-up business. No customer details, no payments, no secret keys.
• Choose your tools. Plan in a chat assistant like ChatGPT or Claude, then build in Cursor. Cursor, ChatGPT or Claude? Which to use for what explains the split, and Lovable, Bolt, v0 or Cursor compares the browser builders with Cursor.
• Use the five habits from day one, even on a tiny project. They're much easier to learn before a client is waiting.
• Stop before real customers. Before a site takes orders, stores anyone's details or has a login, learn to read the code, fix errors calmly and lock it down.

07Learn to build with AI the proper way

The Institution's course teaches building properly with AI, not vibe coding. Module 2, The Prompt System, covers the brief, the five prompt levels, planning in ChatGPT and building in Cursor, and reviewing what the AI changed. It also sets up the build loop: change, preview, check, commit. Module 4 (Read the Code) teaches you to read what the AI wrote. Module 5 (Fixing Things) covers error messages, AI that goes in circles and undoing anything with Git. Module 10 (Lock It Down) walks you through checking every key, database rule, form and login, and ends with a security checklist for every launch.

The full course is 15 modules in three stages, at your own pace. You build your own studio site first, then a business site with orders, emails and an owner login. Module 0 is free with a free account, so you can see how the course teaches first, then look at the full course.