Vibe coding is an approach to creating software in which a person describes a desired result to a large language model and repeatedly requests changes based on the program’s behavior, often without closely reading or understanding the generated code. The term originated with Andrej Karpathy in February 2025. In its narrower sense, it describes accepting AI-generated implementations with minimal code review; broader usage extends it to conversational, AI-assisted development generally. This difference in meaning is central to discussion of the practice. (simonwillison.net)
Origin and meaning
Karpathy introduced the expression in a social-media post describing an informal workflow for disposable projects. He accepted generated changes, returned error messages to the model, and requested further modifications rather than investigating every implementation detail. The emphasis was on obtaining a working result while allowing the codebase to grow beyond his immediate understanding. (simonwillison.net)
Programmer Simon Willison subsequently distinguished this practice from software engineering supported by AI. Under his definition, software that has been thoroughly reviewed, tested, and understood is not vibe coding merely because a model wrote it. By May 2025, he was also documenting broader uses of the expression in publishing, including its application to professional AI-assisted development. The term therefore does not consistently identify a particular level of human oversight. (simonwillison.net)
Technical basis and workflow
Vibe coding relies on generative artificial intelligence capable of producing and modifying code. Coding assistants combine a user’s request with context such as existing files and conversation history, then generate an implementation or proposed changes. Natural-language instructions guide the system, but the resulting software still uses a conventional programming language. (docs.github.com)
The characteristic interaction is a repeated cycle:
- Describe a feature or desired behavior.
- Have the model generate or modify the implementation.
- Run the program and inspect its visible behavior.
- Return errors or request changes.
- Repeat until the result appears satisfactory.
In the original usage, this cycle substitutes substantially for direct inspection of the code. Merely communicating with a coding assistant through chat does not establish that a developer is following that approach. (simonwillison.net)
An AI agent can automate additional parts of the cycle, including editing files, executing commands, and running tests. Such capabilities describe what the tool can do, rather than how carefully its output is supervised. Official coding-agent documentation explicitly treats human oversight and output review as separate requirements. (docs.github.com)
Applications and boundaries
Prototyping is an explicit use case for coding agents: they can create initial implementations that allow developers to explore an idea. They can also implement incremental features, extend test suites, and update software documentation. These activities become vibe coding in the narrow sense only when the user largely relinquishes inspection and understanding of the implementation. (docs.github.com)
The distinction matters when comparing a demonstration with production software. A demonstration may establish that a particular interaction works, whereas production development also involves maintainability, performance, accessibility, security, and continued modification. Willison’s original discussion emphasized small, low-stakes projects rather than treating visible success as evidence of production readiness. (simonwillison.net)
Limitations and risks
Incorrect output. Coding assistants can generate code that appears plausible but is syntactically invalid, implements the wrong behavior, or misinterprets a request. This is related to AI hallucination. Generated tests may also omit relevant cases, so their presence alone does not establish correctness. (docs.github.com)
Security and privacy. Unvalidated generated code can introduce security vulnerabilities, insecure dependencies, or embedded credentials. Agents with access to code and sensitive information can also create privacy risks through accidental disclosure or malicious input. These concerns extend beyond whether an application’s interface appears to work. (docs.github.com)
Tool execution. Giving an agent permission to modify files and execute commands introduces risks distinct from receiving text suggestions. GitHub’s documented controls illustrate this separation: restricted execution environments, limited repository permissions, security scanning, audit logs, and human review before merging changes address different possible failures. They are safeguards around automation, not proof that generated software is correct. (docs.github.com)
Terminological controversy
The principal disagreement concerns whether vibe coding should retain its original meaning of building software without attending closely to the implementation, or function as an umbrella term for AI-assisted programming. Willison argues that the broader meaning obscures the difference between unchecked generation and accountable development. The distinction is consequently about review and understanding, not simply the proportion of code written by a model. (simonwillison.net)
References
- Not all AI-assisted programming is vibe coding (but vibe coding rocks)simonwillison.net
- Two publishers and three authors fail to understand what “vibe coding” meanssimonwillison.net
- Application card: GitHub Copilot Chatdocs.github.com
- Application card: GitHub Copilot Agentsdocs.github.com
- Risks and mitigations for GitHub Copilot cloud agentdocs.github.com