Andrej Karpathy popularized the term "vibe coding" in February 2024: describe the task to an LLM, accept the code it returns, and move on without reading. The Wikipedia entry records the origin and the current definition.

For demos, internal scripts, and personal prototypes, the method ships fast and the cost of a mistake stays with whoever experimented. The math changes once the code enters a system with users, payments, and personal data.

Where the method works

  • Boilerplate: CRUD, DTOs, build configuration, repetitive decorators.
  • A data migration script with closed scope and a single run.
  • A screen prototype used to validate flow with the team before investing in structure.
  • A smoke test for a small feature.

In those four cases an error costs minutes, and reading line by line does not pay for the time.

What the model does not know about your system

An LLM learns public code patterns and reproduces them with fluency. It works without:

  • The business invariant the team defends, such as "a cancelled order does not return to the queue."
  • The implicit contract between services that lives in conversation and not in code.
  • The latency curve agreed with the client.
  • The trade-off history that explains the odd solution in the billing module.

Generated code comes out correct in the training set's context. In your domain, correctness depends on someone checking.

Generated tests carry the same gap

The counter-argument shows up early: a green suite replaces reading. A generated test covers the happy path the model can see. The test that protects the system encodes a business rule, and that rule is the part the model works without. Chapter 11 of Software Engineering at Google treats testing as a tool for changing code safely, which depends on the test encoding the right property.

Another cost sits beside it. Code nobody understood cannot answer questions during an on-call shift. The incident commander asks what that handler does, and the team has no answer.

What a mistake costs in production

  • Missing input validation opens an injection vector, one of the categories in the OWASP Top 10.
  • A token printed into a log leaks through the aggregator, which keeps the file for weeks.
  • A missing lock in payment logic duplicates a transaction.
  • A retry without idempotency runs the job again after a timeout.

All four happen with human-written code as well. The Google SRE Book describes production as the responsibility of whoever wrote and operates the service, and that responsibility survives any generation tool.

The arrangement production needs

  • You describe the problem, the AI returns an approach, and you read the file before the commit.
  • Business logic goes through the same filter as a junior's pull request: rule, boundary, test.
  • Security code gets read for what it does.
  • You keep the ability to explain the file out loud. If the explanation stalls, go back and read it again.

This arrangement slows nothing down. It puts the reading where mistakes are expensive and hands the rest to the model.

References