Vibe Coding, One Year Later: The Receipts Are In

Illustration: chili pepper mascot illustrating Vibe Coding, One Year Later: The Receipts Are In

Vibe Coding, One Year Later: The Receipts Are In

February 2, 2025. That's when Andrej Karpathy put "vibe coding" on the map. A year later, almost to the day, on February 8, 2026, Karpathy reportedly called the framing passe. He's moved on, now talking about agentic engineering. The initial wave of enthusiasm, the promises of effortless creation and instant productivity, has had a full year to play out. So, what do the ledgers actually show?

The numbers are in, and they paint a picture far removed from the marketing brochures. The vendors pushing these tools promised a shortcut to code. What we got was often a shortcut to trouble.

Consider developer sentiment. Stack Overflow's 2025 survey showed 84 percent of developers using AI tools. That's widespread adoption. But positive sentiment? It dropped from over 70 percent to 60 percent. A significant slide. Why the souring mood? Sixty-six percent of developers reported frustration with "almost right" solutions. That's not a minor annoyance; it's a productivity drain, forcing manual fixes and debugging.

Performance metrics tell a starker story. A recent trial found experienced developers were 19 percent slower while believing they were faster. This isn't just a perception gap; it's a tangible hit to output. Technical debt, that silent killer of projects, is not reliably repaid when code is generated without full understanding. Security flaws, the kind that keep CISOs awake at night, linger longest in this kind of codebase. The old rule still holds: never ship code nobody on the team can explain.

Security concerns are not theoretical. OWASP, the authority on web application security, added vibe coding as a risk class. This isn't a casual observation; it's a formal recognition of systemic vulnerability. Veracode reported that 45 percent of AI-generated code carried OWASP Top 10 vulnerabilities. That's nearly half, straight out of the box, requiring immediate remediation. The cost of fixing these issues post-generation often outweighs any perceived initial speed gain.

The promise of rapid development also needs a reality check. YC Winter 2025 saw 25 percent of teams with 95 percent of their code AI-generated. That's a lot of code, fast. But what kind of code? Stripe, a company known for its engineering rigor, migrated 10,000 lines of Scala to Java. They did it in four days. This wasn't AI-generated. It was a focused, human-driven effort that would have taken ten engineering weeks otherwise. This example highlights that targeted, well-understood automation can be powerful, but it's a different beast from the broad-stroke "vibe coding" approach.

The Discourse

The initial hype around vibe coding has given way to a more sober assessment. The conversations now focus on accountability, understanding, and actual value.

One writer put it plainly: "Trust is not the absence of control. It is the ability to explain, test and reconstruct what actually happened." Between Control and Trust v2 This cuts to the core of the issue. If you can't explain the code, you can't trust it. If you can't test it rigorously, you're flying blind. And if you can't reconstruct its creation, you've lost all control.

Another observer noted a critical shift in product development: "Vibe coding did not kill the MVP. It killed the M." Vibe Coding Didn't Kill the MVP. It Killed the M. The "M" here stands for "minimum." When anyone can build a product in a weekend, nobody asks what we are trying to learn. The focus shifts from validated learning to sheer output, often without a clear purpose or understanding of user needs. This leads to a glut of unvalidated products, not innovation.

Even Karpathy, the figure who popularized the term, has moved on. His shift to agentic engineering suggests a recognition that simply generating code based on a "vibe" isn't the end game. It's about building systems that can reason, plan, and execute with more autonomy and, crucially, more explainability. The era of just "vibing it" appears to be over.

The receipts point to a simple rule, and it is not anti-AI. Use the tool where you can still read the result, test it, and fix it without starting over. That is where the Stripe example belongs: a clear task, a known codebase, and humans who could say what changed and why. The opposite is the weekend product pile, where speed hides the missing question. What did anyone learn? Who will maintain this in six months? What happens when a security report lands and nobody can trace the vulnerable line back to a decision? Those questions do not disappear because generation was fast. They arrive later, with interest, and they are paid in debugging hours, incident reviews, and rewrites.

Sources and further reading

Between Control and Trust v2 Vibe Coding Didn't Kill the MVP. It Killed the M. Vibe Coding Grew Up and It Has a Hangover Vibe Coding in 2026: What Actually Works and What Will Burn You * Vibe Coding 2026: Definition, AI Development Lexicon