Skip to content

What is vibe coding? A business definition

Vibe coding is building software by describing what you want to an AI tool and accepting what it generates, often without reading the code. As of October 2026, the term is used loosely for almost any app built with AI help, including apps built by staff who aren't developers. That matters to a business because staff are already building apps this way, often outside IT, and some of those apps hold real company and customer data. In body copy this site calls the practice AI-assisted building, and calls the results worker-built apps.

Use already runs ahead of formal adoption. In a Federal Reserve analysis, about 41% of US workers used generative AI for work in November 2025, while only about 18% of firms reported using AI in any business function at the end of 2025.3 Research on software teams finds that AI amplifies what's already there: it helps teams with strong testing and review, and makes weak ones less stable.4

Who this is for

Executives, IT managers and anyone meeting the term for the first time. You'll get a working definition, how it differs from the neighboring terms, and the words this site uses instead. Reading time: about 6 minutes.

Where the term came from

The computer scientist Andrej Karpathy coined "vibe coding" in a social media post in February 2025. He described giving in to the AI and forgetting "that the code even exists", a style he presented as fine for throwaway weekend projects.1 By 2026 it covered everything from developers using coding agents to analysts in AI app builders.

A year on, in February 2026, Karpathy himself called vibe coding passé for professional work and proposed "agentic engineering" instead: "orchestrating agents who do and acting as oversight", which takes real expertise.2 It's the same line this page draws between vibe coding and disciplined AI-assisted work.

Professional developers draw a line that the wider usage doesn't. In the 2025 Stack Overflow developer survey, 77.5% of respondents said vibe coding isn't part of their professional work (the survey defined it as generating software from LLM prompts, a broader definition than this page's).5 For them, "vibe coding" means unreviewed generation, and AI-assisted development means using AI inside a normal engineering process with tests and review.

The terms, defined

Vibe coding
Building software by prompting an AI tool and accepting its output, often without reading or testing the code. Used loosely, it means any app built with AI help.
AI-assisted building
This site's term for using AI tools to generate or change an app's code or configuration, by anyone. It's neutral about how carefully it's done; the lifecycle supplies the care. See the glossary entry.
Worker-built app
An app, automation or agent built outside a funded engineering team's normal delivery process, by anyone, including professional developers building their own tools, with or without AI help. It includes automations, scheduled jobs, workflow-tool flows with AI steps, and agents built in SaaS agent builders or coding tools. They're tiered, registered, owned and retired like any other app.
Citizen development
The older IT-governance term for business staff building apps, usually on low-code or no-code platforms that IT has approved. A citizen developer is the person doing it. This site says builder.
Low-code / no-code
Platforms where people build apps by configuring forms, tables, flows and connectors, with little or no hand-written code. Many now add AI assistants that generate the configuration from a prompt.
AI-assisted development
Professional developers using AI coding assistants and coding agents inside an engineering process: version control, tests, code review and a release pipeline.
AI feature
Something an app does by calling an AI model while it runs, such as summarizing tickets or drafting replies. That's a different risk from building with AI, and it has its own controls (see the glossary entry).

Vibe coding vs. citizen development

The two terms describe overlapping groups, and people use them for different questions. "Vibe coding" leads in press and security coverage; "citizen developer" leads in governance and ROI discussions.

The same split shows up when people name the apps. Many organizations, especially their IT and governance teams, say citizen-developed apps; press and security writing says vibe-coded apps. In practice the two labels now cover much the same thing: an app a worker built outside IT's normal delivery process. Use "citizen-developed" in a policy, a program charter or an ROI case for readers who already run or fund a citizen developer program, and "vibe-coded" when your readers are thinking about AI tools and their risks. This site uses either one in titles and summaries, and says worker-built app everywhere else.

Vibe coding (as commonly used) Citizen development AI-assisted development
Who builds Anyone: staff in any role, and developers working fast Business staff (analysts, operations, finance, HR) Professional developers
Typical tools (by capability) AI app builders that generate and host an app from a prompt; chat assistants; coding agents Low-code and no-code platforms, workflow and form tools, spreadsheets Coding assistants and coding agents in an editor or terminal, with version control
Typical apps Prototypes, internal dashboards, trackers, forms, small customer-facing sites Team apps, approvals, trackers, automations on company data Features in products and internal systems
Main risks Public-by-default data, keys in the front end, no owner, nobody else can maintain it Unregistered apps in a business process, apps orphaned when the builder leaves Fluent but wrong or insecure code accepted as reviewed; agents with too much access
Governance needed Approved tools, private by default, a risk tier before sharing A registry, owners, risk tiers and support levels Tests, review depth matched to risk, agent permission controls
Where this site covers it Builder handbook, risks Operating model, risk tiers Verify before release, coding agents

One practical difference is the platform. Citizen development usually happened inside a platform IT had chosen and could administer. Vibe coding often happens in tools IT never approved. In an October 2025 scan of more than 5,600 publicly reachable apps built on public AI app builders, many by non-developers, one vendor reported over 2,000 vulnerabilities, more than 400 exposed secrets and 175 instances of exposed personal data.6 Another vendor examined about 380,000 assets, found about 5,000 apps built for corporate purposes, and reported that about 40% of those exposed sensitive data.7 Both are vendor research, but they point the same way.

Don't: borrow a vendor's definition as the standard

Vendor definitions tend to stress that anyone can build anything. Define vibe coding for your business by effect: what data the app touches, who uses it, and what it can do. That sets its risk tier, whatever the tool.

Is vibe coding the same as AI-assisted development?

No, though the overlap is growing. AI-assisted development keeps the engineering process and puts AI inside it. Vibe coding, in its original sense, skips that process: no reading, no tests, no review. For a business, the useful question is whether the app has passed the checks its risk calls for before other people rely on it, whatever label it carries. The UK National Cyber Security Centre made the same point in June 2026. It described a "vibe coding spectrum" and said scrutiny should rise with the stakes, from low-risk prototypes to apps handling sign-in, personal data or secrets.8

Don't: put unreviewed generated code into production

Accepting fluent output without tests or review is AP10: fluent-but-wrong code accepted as reviewed (failure patterns). In a randomized study, people using an AI assistant wrote less secure code and were more confident it was secure.9 Practitioner guidance rates complacency with AI-generated code as "Hold".10 Vibe coding as originally described is fine for a Sandbox experiment on approved tools, not for anything other people depend on.

Is vibe coding safe for a business?

It can be, when the safe path is the easy path: approved tools, private by default, and checks that scale with each app's risk tier. The risks and the control for each are on the vibe coding risks page, and whether to enable it at all is on should staff build apps with AI?

What does this site call vibe coding, and why?

We use plain, neutral terms in body copy, so the words don't imply either a careless practice or a vendor's product category. Search terms appear in titles, descriptions and opening paragraphs where readers search for them, and each is defined once in the glossary.

Search term This site's term Why
vibe coding AI-assisted building Covers careful and careless use alike; the controls do the rest
vibe-coded app, citizen-developed app, citizen app worker-built app Includes automations and agents, AI-built or not
citizen developer builder Shorter, and doesn't imply a job title
shadow AI unsanctioned AI use Describes the behavior without judgment
vibe coding platform AI app builder Names the capability, not a brand

Assumptions and evidence

  • A-041 (Low): we expect risk and security searchers to use "vibe coding" more than "citizen developer", and governance and ROI searchers the reverse. Test this by comparing the query terms that bring readers to this page and to the governance pages.
  • A-003 (High): we expect most would-be builders in a typical business to already use AI tools at work, many of them unapproved. Test this by comparing your app registry and approved-tool sign-ins with network or identity discovery data.

Evidence: a central-bank analysis of official adoption data, one developer survey and one developer-research report, two vendor security scans, a government security agency blog, one peer-reviewed user study, and news reports of the coiner's own posts. There's no independent census of worker-built apps. Facts on this page are as of October 2026.

  1. Andrej Karpathy, post on X, 2 Feb 2025 [primary], https://x.com/karpathy/status/1886192184808149383, accessed 2026-10-21. The X post couldn't be opened from our fetcher; the date and wording match wide news coverage, including reports of Collins Dictionary naming "vibe coding" its Word of the Year 2025 and crediting Karpathy with coining it in February 2025 [news], https://www.yahoo.com/news/articles/vibe-coding-named-word-collins-112846718.html, accessed 2026-10-21. ↩

  2. The New Stack, "Vibe coding is passé. Karpathy has a new name for the future of software", Feb 2026 [news], https://thenewstack.io/vibe-coding-is-passe/, accessed 2026-10-21. Karpathy's own post (Feb 2026, on X) couldn't be opened from our fetcher; the quoted wording matches several independent reports. ↩

  3. Board of Governors of the Federal Reserve System, "Monitoring AI adoption in the U.S. economy", FEDS Notes, 3 Apr 2026 [research], https://www.federalreserve.gov/econres/notes/feds-notes/monitoring-ai-adoption-in-the-u-s-economy-20260403.html, accessed 2026-10-21. The firm figure follows a November 2025 change in the Census survey question. ↩

  4. DORA, "State of AI-assisted Software Development 2025", Sep 2025 [research], https://dora.dev/research/2025/dora-report/, accessed 2026-10-21. ↩

  5. Stack Overflow, "2025 Developer Survey: AI", Jul 2025 [survey], https://survey.stackoverflow.co/2025/ai, accessed 2026-10-21. ↩

  6. Escape, methodology post on its scan of apps built on AI app builders, 29 Oct 2025 [vendor], https://escape.tech/blog/methodology-how-we-discovered-vulnerabilities-apps-built-with-vibe-coding/, accessed 2026-10-21. ↩

  7. Red Access, security report on AI app builders [vendor], https://info.redaccess.io/shadow-ai-builders-security-report, accessed 2026-10-21. The report is undated; press coverage dates it to May 2026. ↩

  8. UK National Cyber Security Centre, "The vibe coding spectrum: an approach to AI-assisted software development", 18 Jun 2026 [primary], https://www.ncsc.gov.uk/blogs/the-vibe-coding-spectrum-approach-to-ai-assisted-software-development, accessed 2026-10-21. ↩

  9. Perry, Srivastava, Kumar and Boneh, "Do Users Write More Insecure Code with AI Assistants?", ACM CCS 2023 [research], https://arxiv.org/abs/2211.03622, accessed 2026-10-21. It used a 2022-era model; the overconfidence finding is a human-factors result that still holds. ↩

  10. Thoughtworks Technology Radar, "Complacency with AI-generated code" (Hold), 2025 [primary], https://www.thoughtworks.com/radar/techniques/complacency-with-ai-generated-code, accessed 2026-10-21. ↩