What Is Vibe Coding? With the Data on Whether It Actually Makes You Faster

Vibe coding is writing software by describing what you want in plain language and letting AI produce the code — without reading what comes back. The not-reading part is the definition, not merely using AI for help. The term was coined by Andrej Karpathy, former director of AI at Tesla, on 2 February 2025, and became Collins Dictionary's Word of the Year for 2025. What makes this different from other explainers: it includes the actual research, because the available data paints a picture that conflicts with how using these tools feels.

Where the Term Came From

Karpathy wrote: > "There's a new kind of coding I call 'vibe coding', where you fully give in to the vibes, embrace exponentials, and forget that the code even exists." In the same post he described his workflow: accepting AI-generated code without reading diffs, pasting error messages back without comment, and working around bugs he could not fix rather than fixing them. The part people miss: Karpathy was not proposing this as a general engineering practice. He described it in the context of throwaway weekend projects where mistakes cost nothing.

Is It Actually Faster? The Data Says Otherwise

In 2025 METR ran a randomized controlled trial with 16 experienced developers across 246 tasks. Allowing early-2025 AI tools increased completion time by 19%. The more interesting number: before starting, participants predicted AI would make them 24% faster. The gap between how it felt and what happened is the real finding.

What About Code Quality?

Two independent sources point the same direction. GitClear's longitudinal analysis found refactoring dropped from 25% to under 10%, code duplication rose roughly fourfold, and churn — code written then quickly changed or deleted — nearly doubled. CodeRabbit reported in December 2025 that AI co-authored code showed 1.7x more 'major' issues and 2.74x more security vulnerabilities.

Documented Failures

Not just numbers in reports — these were recorded incidents:

• •July 2025 — a Replit AI agent deleted a user's production database despite explicit instructions not to make changes
• •May 2025 — 170 of 1,645 web applications built with Lovable were found to have vulnerabilities exposing personal information

The Risk Thai Businesses Need to Weigh Separately

The Lovable incident is where this stops being a technical problem and becomes a legal one. If you vibe code an app that stores customer names, phone numbers, emails, or national ID numbers, and that code contains a hole you never read — you remain the data controller under Thailand's Personal Data Protection Act (PDPA). Liability does not transfer to the AI or the platform you built on. Plainly: anything touching customer personal data should not be vibe coded. Not because AI writes bad code, but because not reading the code means not knowing what leaks — and you are the one answerable for it.

The Rule I Actually Use

After a long stretch of using these tools on real work, my rule has one question: if this code breaks, who gets hurt? If the answer is "only me" — go full speed. Prototypes, one-off scripts, internal tools with one user. Vibe coding pays off there because the cost of being wrong is my own time. If anyone else is in the answer — customers, money, personal data, a system another team inherits — I read every line. I still let AI write it, but nothing gets merged that I cannot explain. One thing that genuinely helps is giving the AI real data instead of letting it guess, which is what MCP is for. To see how these pieces fit into a whole system, read What is an Agent Harness.