"Vibe coding" was Collins Dictionary's Word of the Year 2025, and with good reason: 90% of software development professionals now work daily with artificial intelligence, spending a median of two hours per day on it (Google Cloud DORA report, 2025). But between the enthusiasm and the reality lies an uncomfortable finding: in the most cited controlled trial in the field, developers using AI believed they had worked 20% faster — and had in fact worked 19% slower. This guide explains exactly what vibe coding is, which tools dominate in 2026, what the data actually says — good and bad — and when it makes sense (and when it does not) to bring it into your organisation.
What Is Vibe Coding?
Vibe coding is a way of creating software by describing in natural language what you want and letting artificial intelligence write the code, without reviewing in detail — or without understanding — what it generates. The term was coined by Andrej Karpathy, co-founder of OpenAI, in February 2025: "There's a new kind of coding I call 'vibe coding', where you fully give in to the vibes, embrace the exponentials, and forget that the code even exists." What started as an offhand remark — Karpathy himself later called it "a shower-thoughts tweet" — became a category: in November 2025 Collins named it Word of the Year. The underlying idea is real and powerful: the barrier between having a software idea and having a working prototype has collapsed to a matter of hours. The trap, as we will see, lies in confusing that prototype with a product ready for customers.
The Tools Dominating Vibe Coding in 2026
The market matured at record speed. Here is the landscape at mid-2026:
| Tool | What it is | Market signal |
|---|---|---|
| Cursor (Anysphere) | Agentic IDE, the professional standard | From $100M to $2B ARR in 13 months; acquired by SpaceX for $60B (Jun 2026) |
| Claude Code (Anthropic) | Terminal-based agentic coding | The reference for professional agentic development |
| GitHub Copilot (Microsoft) | Assistant + integrated agent | 4.7M paying subscribers; 90% of the Fortune 100 |
| Lovable | Prompt → complete application | 8M users and $6.6B valuation; protagonist of the 2026 security crisis |
| Replit | Full-stack cloud agent | Protagonist of the deleted-database incident (Jul 2025) |
| v0 (Vercel), Bolt.new | UI generation and prototyping | Second tier, widely used in product design |
Two takeaways for a leadership committee: first, this is no longer a trend — when a programming tool is acquired for $60 billion, it is infrastructure. Second, the two most "magical" tools on the list (Lovable and Replit) are also the two with documented serious incidents. The magic and the risk come in the same package.
Does It Work? What the Data Says, Not the Hype
Adoption is massive and perceived productivity extremely high: 84% of developers use or plan to use AI (Stack Overflow, 2025) and more than 80% report being more productive (DORA, 2025). But when outcomes are measured rather than surveyed, the picture becomes more nuanced. The METR randomised trial (July 2025) set 16 senior developers the task of completing 246 real tasks in their own repositories: with AI they were 19% slower, while estimating they had been 20% faster. The study has limits — expert developers on code they knew by heart, tools from early 2025 — but its lesson stands: the feeling of speed is not speed. The industry itself inflated expectations: in March 2025 it was predicted that AI would write 90% of all code within six months; a year later, the real figures hover around 25–30% at Microsoft and Google, and 50–70% at Anthropic itself. The honest conclusion: AI genuinely accelerates certain tasks — prototypes, repetitive code, tests — and can slow down others, and almost no one on your team will be able to tell the difference without measuring.
The Risks That Never Appear in the Demo
Three bodies of evidence that any serious decision must consider. Security: the Veracode GenAI Code Security report (2025, more than 100 models evaluated) found that AI-generated code introduces vulnerabilities 45% of the time — 72% in Java — and that while syntactic correctness exceeds 95%, security has been stagnant for two years. Technical debt: GitClear analysed 623 million lines modified between 2023 and 2026: code duplication grew by +81%, copy-paste by +41%, and refactoring — the work that keeps software healthy — fell from 21% to 3.8% of lines (−70%). That bill does not arrive in the demo; it arrives in year three. Real incidents: in July 2025 Replit's agent ignored an explicit code freeze and deleted a production database containing 1,206 records belonging to executives; in 2026, more than 170 applications generated with Lovable exposed their databases through a configuration vulnerability (CVE-2025-48757). And the Tea app breach — 72,000 selfies and identity documents leaked — is routinely cited as a vibe coding cautionary tale, though AI causation has not been proven: the real lesson is that security as an afterthought is extremely costly.
Vibe Coding vs Vibe Engineering: The Distinction That Matters
The professional community has already separated the two worlds. Simon Willison — one of the most respected developers in the ecosystem — proposed in October 2025 calling the professional use of AI agents vibe engineering: with planning, automated tests, code review, continuous integration, and documentation. Pure vibe coding — accepting whatever comes out without looking at it — is reserved for throwaway prototypes. His thesis is the most useful thing a business leader can take away: "AI tools amplify existing expertise." A senior team with good practices multiplies its reach; a team without judgement multiplies its mistakes, but now at machine speed. The data that confirms it: 90% of developers already use AI, yet 46% distrust the accuracy of what it produces (Stack Overflow, 2025). That gap between mass adoption and scarce trust is not closed with more tools — it is closed with training.
When Does Vibe Coding Make Sense for Your Business?
Our decision matrix — the one we apply with clients:
Yes, enthusiastically:
- Prototypes and idea validation: turning a business idea into a navigable demo in hours to test with real users before committing investment.
- Internal tools without sensitive data: calculators, dashboards, team automations.
- Sales demos and proof-of-concept for pre-sales.
Not without engineering:
- Production with customer data: anything that touches personal data requires human security review — the 45% vulnerability rate from Veracode is not an opinion.
- Regulated systems: GDPR, NIS2, DORA (the financial regulation — not to be confused with the Google report, a confusion more common than it might seem), healthcare.
- Core business systems: billing, ERP integrations, payment gateways. Here, pure vibe coding is the equivalent of signing contracts without reading them.
The practical rule: vibe coding buys learning speed, not product quality. Use it to decide what to build; build with engineering.
How to Prepare Your Team (The Gap Is Not About Tools)
"Every company asks us which vibe coding tool to buy. Almost none asks how to review the code that AI generates — and that is exactly where the decision is made between multiplying or dividing results. The tool is the easy part; the judgement is what gets trained," says Alfons Marques, founder of Technova Partners.
Three concrete moves:
- Tiered usage policy: what can be vibe-coded freely (prototypes), what requires review (internal tools), and what requires a full engineering process (production). Without a policy, every employee makes that call individually.
- Specific training in AI-assisted development: reviewing generated code, writing technical prompts, tests as a safety net, and detecting typical vulnerabilities. Our vibe coding training for teams covers exactly this bridge — and qualifies for subsidised funding through FUNDAE (Spain's state-backed corporate training scheme).
- Measure real productivity, not perceived productivity: the METR paradox — feeling 20% faster while being 19% slower — is avoided with flow metrics: cycle time, rework rate, post-deployment incidents — not satisfaction surveys. If you need to build serious software at AI speed with engineering quality, our web development team works exactly this way.
Is your team already using AI to code and unsure whether it is helping or creating debt? Tell us about your situation and we will propose an assessment using real metrics.
Conclusion
Vibe coding is real, it is here to stay, and it has reduced the distance between idea and prototype to a matter of hours — with tools that are now market infrastructure, as the $60 billion Cursor acquisition demonstrates. But the 2025–2026 data draw a clear outline: 45% of code with vulnerabilities, duplication surging, refactoring collapsing, and a productivity paradox that is only detectable through measurement. The distinction that matters is not AI yes or no: it is vibe coding to learn fast and vibe engineering to build seriously. The companies that will win are not those that buy the most licences, but those that train their teams' judgement to know, at any given moment, which of the two modes they are in.
Frequently Asked Questions About Vibe Coding
What is vibe coding in a nutshell?
It is creating software by describing what you want in natural language and letting artificial intelligence generate the code, without reviewing it in detail. The term was coined by Andrej Karpathy in February 2025 and was Collins Dictionary's Word of the Year 2025. It is ideal for rapid prototyping; risky as a method for building production products.
Will vibe coding replace programmers?
The data say no, but it changes the work. 90% of developers already use AI daily (DORA 2025) and at companies like Microsoft and Google, AI writes 25–30% of the code — far from the 90% predicted. Human expertise becomes more valuable, not less: AI tools amplify the judgement of whoever uses them, and reviewing generated code is the new critical skill.
Is it safe to use AI-generated code in my company?
It depends on the destination. According to Veracode (2025), AI-generated code introduces vulnerabilities 45% of the time, and there are documented serious incidents (databases deleted or exposed at Replit and Lovable). For prototypes and internal tools without sensitive data, the risk is manageable; for production with customer data or regulated systems, AI-generated code requires human security review, tests, and a full engineering process.
What vibe coding tools are available in 2026?
The main ones are Cursor (the standard agentic IDE, acquired by SpaceX in 2026), Claude Code (Anthropic's terminal agent), GitHub Copilot (the most widespread in corporate environments), Lovable and Replit (prompt-to-complete-application), and v0 or Bolt.new for interfaces and prototypes. The choice of tool matters less than the usage policy: defining what can be AI-generated freely and what requires review and engineering.
