Key takeaways
- Vibe coding means describing what you want to an AI and letting it write the software, often without anyone reading the code.
- It can be a good way to test an idea or build a low-risk internal tool.
- The NCSC says to match oversight to risk: more freedom for prototypes, more human control for logins, personal data and secrets.
- If customers, payments or personal data are involved, get the code reviewed by a developer before launch.
What is vibe coding?
The term was coined by Andrej Karpathy in February 2025 to describe building with AI while you "forget that the code even exists". It spread quickly, and Collins Dictionary named it its Word of the Year for 2025. Collins defines it as using artificial intelligence, prompted by natural language, to assist with writing computer code.
In practice it covers a range. At one end, you type a short request and an AI agent builds a whole app. At the other, a developer uses AI to autocomplete a few lines. Most real work sits somewhere in between.
How does vibe coding work?
The loop is simple:
- You describe what you want, for example "a page where staff can log holiday requests".
- The AI writes the code and often runs it.
- You try it, say what is wrong, and the AI changes it.
- You repeat until it looks right.
The tools differ, but the pattern is the same. What changes the risk is how much a person checks along the way.
What is vibe coding good for?
It is a good fit when speed matters more than polish and the damage from a mistake is small:
- Prototypes and demos. Showing a team or investor what an idea could look like.
- Internal tools with limited exposure. A small tracker only your team uses, with no sensitive data.
- Learning and experiments. Finding out whether an idea is worth building properly.
A working prototype can save weeks of discussion. If the idea survives, it is often worth rebuilding it properly, as we explain in our guide to MVP development for startups.
What are the risks of vibe coding?
The UK's National Cyber Security Centre (NCSC) addressed this in a June 2026 blog post. It makes two main points:
- Security. AI models learn from existing code, and some of that code has security flaws. With little oversight, there is a real risk of vulnerabilities.
- Maintainability. The code can become complicated and confusing, which causes problems later when someone has to change it.
Independent testing points the same way. Veracode's 2025 GenAI code security study found security flaws in about 45% of its test cases. That was a set of 80 coding tasks run across more than 100 AI models. It is one study with its own method, so treat it as a warning, not a forecast for your project.
There are business risks too. If nobody understands the code, a departing contractor or a broken tool can leave you stuck. And if the software handles customer data, you are still responsible for protecting it under UK GDPR, whoever or whatever wrote it.
What does the NCSC say about vibe coding?
The NCSC does not say "don't". It describes a spectrum, from fully manual coding with light AI help to full vibe coding, and says to choose your position based on the risk.
It suggests leaning towards full vibe coding for:
- prototypes and proofs of concept where speed matters
- demos that communicate an idea
- internal tools with limited exposure
- work with no sensitive data or security functions
It suggests leaning towards manual control for:
- login and permission logic
- sensitive personal data
- secrets, tokens and credentials
- safety-critical code
- anything where a security flaw would have serious consequences
For higher-risk code, the NCSC says people should review what the AI produces, understand it, check it for vulnerabilities and verify that it does what is expected. It also says this may change as models improve, but advises working from today's reality.
When should a business use vibe coding, and when should it hire developers?
A simple test: what is the worst thing that happens if this is wrong?
- Low stakes: vibe coding is a reasonable way to try it. Keep it away from real customer data.
- Medium stakes: use AI to speed up the work, but have a developer design the structure and review the code.
- High stakes: if it takes payments, holds customer accounts or personal data, or your business depends on it, have professionals build or at least review it.
Using AI does not remove the need for the basics: a clear brief, a plan for hosting and backups, and someone who owns the code. Our guide to software project risks covers what tends to go wrong.
Already built something with vibe coding?
Many businesses now have an app that started as a quick experiment and became important. Before real customers rely on it, ask:
- Who can read and maintain the code?
- Where are passwords, keys and customer data stored?
- Is it backed up, and could you restore it?
- What happens if the tool or the person who built it is no longer available?
If you cannot answer these, a technical audit gives you an independent view of the risks and a suggested order for fixing them. If the prototype proves the idea, our custom software development team can rebuild it so you own and understand it.
Frequently asked questions
What does vibe coding mean?
It means using AI to write software from plain-language instructions, often without reading the code. Collins Dictionary defines it as using artificial intelligence, prompted by natural language, to assist with writing code.
Is vibe coding safe?
It depends on what you build. The NCSC says full vibe coding can be fine for low-risk work such as prototypes and limited internal tools, and that more human oversight is needed for logins, personal data and secrets.
Is vibe coding the same as using AI to help write code?
Not exactly. The NCSC describes a spectrum. A developer who accepts a few AI suggestions is at one end, and someone who lets an AI build everything without reading it is at the other.
Can I build a business app with vibe coding?
You can build a first version. Before customers use it, especially if it handles personal data or payments, have the code reviewed. Our guide on when a business needs AI development may help you decide.
Will vibe coding replace developers?
The NCSC says AI models are improving and trust may grow over time. For now, it advises calibrating to today's reality. In practice, developers are still needed to design, review and look after software that matters to a business.
How much does it cost to turn a prototype into proper software?
It depends on what the prototype does, how sensitive the data is and how much needs rebuilding. Our guide to what custom software costs explains what drives a quote.