Vibe coding

What the term actually meant

Karpathy's original description was specific and slightly self-mocking: you talk to the model, accept diffs without reading them, paste errors back in without analysing them, and when something breaks you ask for a change rather than debug. His own framing was that this is fine for throwaway weekend projects.

That qualifier gets dropped constantly. The term is now used for anything involving an AI coding tool, including careful work where every diff is reviewed — which is just programming with a fast assistant, and not what the word describes.

Where it works

It is genuinely good for a bounded set of things:

• Prototypes and demos whose purpose is to be looked at and then discarded.
• Internal tools with a handful of trusted users and no sensitive data.
• Exploring an unfamiliar library, where working code teaches faster than documentation.
• Non-programmers getting something functional at all — a real expansion of who can build software.

An AI app builder is the tooling built around this workflow, and it makes the loop fast enough that the approach becomes viable for far more people than before.

What to watch out for

The code you did not read is still your responsibility. Not reading it does not move the liability, and this is where the practice stops being harmless:

• Security. Models produce plausible code, and plausible code contains injectable queries, missing authorisation checks and API keys in the client bundle. Nothing in the loop flags these, because the app appears to work perfectly.
• The debugging cliff. Progress is fast until something breaks in a way the model cannot fix by guessing. At that point you must understand a codebase you have never read, and there is no gradual on-ramp.
• Silent wrongness. Business logic that runs without error but calculates the wrong number is invisible to "does it work?" review.
• Accumulated inconsistency. Twenty prompts in, the same concept has three implementations, because each generation only saw part of the picture.

The workable discipline is not abstinence, it is scope. Vibe code the prototype, then read the code before real users or real data arrive — particularly anything touching authentication, payments or personal data. Keeping it in version control from the first commit costs nothing and gives you the ability to see what actually changed.