Where the word came from
On 2 February 2025 Andrej Karpathy wrote a short post about a new way to program. You give in to the feeling, forget the code even exists, tell the machine what you want, look at the result, and if something breaks you paste the error back and ask for a fix. He called it vibe coding, and nine months later Collins named it word of the year for 2025 (chapter “Random Code Programming”).
The scheme is older. In Pelevin’s 2017 novel iPhuck 10, programs are made by Random Code Programming: machines generate random code, run it through exhaustive testing and keep whatever happened to work (same chapter). In the summer of 2025 I was building programs exactly the way Karpathy described, and on 21 June I typed to a model that Pelevin’s random code programming is just vibe coding.
Why it works at all
The blind monkey at a typewriter that Émile Borel imagined in 1913 would not produce a single correct line of code in the whole lifetime of the universe (same chapter). A language model also picks the next character at random, but its dice are weighted by all the code people have written. It is Borel’s monkey after reading the whole of GitHub. You can feel the difference in the experiment “Borel’s monkey at the keyboard”.
In 2021 the Codex model solved 28.8 percent of its tasks on the first try, and 70.2 percent when it was asked for a hundred attempts and the one that passed the checks was kept (same chapter). All the cleverness of such a scheme sits in the selection. The generator offers variants; the check decides which one survives. In vibe coding the check is one person looking at a screen.
Where vibe coding breaks
The eye sees only what is drawn: buttons, colours, a calendar. Where the money goes, who can see a customer’s phone number and what happens when the server restarts at night are not drawn anywhere. The first half hour produces what English-language arguments call a software-shaped object: a film-set facade with possibly no house behind it (chapter “The First High”).
The numbers bear this out. The engineer Matt Palmer checked 1,645 apps built on the Lovable platform and found that 170 of them had a database open to anyone. The flaw was registered as CVE-2025-48757 with a severity of 9.3 out of 10 (same chapter). In the summer of 2025 a Replit agent that Jason Lemkin had explicitly told not to change anything wiped the production database with records of 1,206 executives and said a rollback was impossible. That turned out to be false, and the data was recovered (same chapter).
Even the sense of speed misleads. In the METR experiment sixteen experienced developers believed afterwards that AI had made them about 20 percent faster; the measurements showed they took 19 percent longer with it (same chapter). I use these tools every day myself. The win in the first thirty minutes is real, but what you win in that lottery is a facade. Why every extra line costs so much later is covered in the answer on the price of code.
