· reAPI Team
What Is Vibe Coding? Karpathy's Definition and Its Limits
Vibe coding means accepting AI-written code without reading it. Karpathy's original definition, how coding agents enable it, what it costs and where it breaks.
Vibe coding is building software by describing what you want to an AI model and accepting the code it writes without reading it. Andrej Karpathy named it in a post on February 2, 2025: "a new kind of coding I call 'vibe coding', where you fully give in to the vibes, embrace exponentials, and forget that the code even exists."[1] The same post set its limit. It is "not too bad for throwaway weekend projects."
That second sentence gets dropped from most retellings, and it is the useful part. The practice, often searched as one word (vibecoding), is a fast way to get a prototype on screen. It is a poor way to ship code that handles money, logins or other people's data. This guide covers what Karpathy described, how today's coding agents make it the default, what it costs in tokens and where it fails.
Karpathy's original description of vibe coding
The post lists the habits that define the practice:[1]
- He talked to the editor through a speech-to-text app and "barely" touched the keyboard.
- He asked for small changes, such as halving the sidebar padding, because finding the line himself was more effort.
- He clicked "Accept All" on every change and stopped reading diffs.
- When an error appeared, he pasted it back in with no comment, which "usually" fixed it.
- When the model could not fix a bug, he worked around it or asked for random changes until it went away.
He also said the code grew "beyond my usual comprehension". That is the trade: speed in exchange for not knowing what the program does.
Vibe coding in today's coding agents
In early 2025 it meant an editor plus a habit. In 2026 it is closer to a setting. Claude Code's permission modes decide what runs without asking you, and they map directly onto Karpathy's "Accept All":[2]
| Claude Code mode | What runs without asking | Anthropic's stated use |
|---|---|---|
default | Reads only | Reviewing every action yourself |
acceptEdits | Reads, file edits, common filesystem commands | Iterating on code you are reviewing |
plan | Reads; edits wait until you approve a plan | Exploring a codebase before changing it |
auto | Everything, with background safety checks | Long tasks, fewer prompts |
bypassPermissions | Everything | Isolated containers and VMs only |
Terminal sessions in Claude Code v2.1.283 and later start in auto mode, so the hands-off style is now where a new session begins.[2] auto still runs background safety checks. bypassPermissions drops them, and Anthropic limits it to isolated containers and virtual machines. Even there, a short list of actions still asks first in every mode, such as rm commands aimed at critical paths.
Where vibe coding breaks
The first failure is security. Veracode tested code generated by more than 100 large language models in Java, JavaScript, Python and C#, and reported that AI-generated code introduced risky security flaws in 45% of its tests. Its summary adds that larger, newer models did not produce more secure code.[3] Code nobody reads is where those flaws stay.
The second failure is maintenance. Karpathy's workaround for bugs the model could not fix was to route around them. That works until the workarounds interact, and by then the person who would untangle them has never read the code. Our view: it is fine for a prototype you will throw away, and a review step is needed before anything touches payments, authentication, deletes data or stores secrets.
A few habits keep the speed and add the missing review:
- Plan first on anything you plan to keep. In
planmode Claude Code blocks edits until you approve a plan, so you read intent before code.[2] - Run a review pass. Claude Code bundles a
/code-reviewskill you can run on the diff before committing.[4] - Read the diff at the boundaries. Files that touch the network, the database, credentials or user input deserve a human read even when the rest does not.
- Keep the risky run in a sandbox. If you want zero prompts, do it where Anthropic says to: a container or VM.
What vibe coding costs
The style spends tokens freely. Pasting whole error logs, asking for random changes and letting an agent run for an hour all add input and output. On OpenAI's reasoning models, reasoning tokens are billed as output, so a short visible answer can still bill a long chain of thought.[5]
Anthropic puts the enterprise average for Claude Code at about $13 per developer per active day and $150 to $250 per developer per month, with 90% of users below $30 per active day.[6] Personal sessions can land above or below that; the figure is a reference point, not a forecast.
Model choice moves the bill more than anything else. On OpenAI's list prices, GPT-6.1 Terra costs $1 input and $5 output per million tokens against $10 and $50 for GPT-6 Astra.[7] A cheaper model for the many small "make the button blue" turns, and a stronger one for the hard bug, is a reasonable split. Our GPT model comparison lays out the price and tool differences, and reAPI serves both the GPT and Claude families on one key if you want to switch per task.
FAQ
Who coined the term vibe coding?
Andrej Karpathy, in a post on X dated February 2, 2025.[1]
Is vibe-coded code safe to ship?
Not without review. Veracode found risky flaws in 45% of its AI-generated code tests, and newer models did not fix that.[3] Review the parts that handle money, logins, personal data and deletion before release.
Do I need a special tool for it?
No. Any coding agent that applies changes for you works. In Claude Code, the auto mode that terminal sessions start in already applies changes without asking for each one.[2]
Using vibe coding without losing the codebase
Vibe coding is a good way to find out whether an idea works by tonight. Keep Karpathy's own boundary in mind: weekend projects. When a vibe-coded prototype turns into something people depend on, switch to plan mode, read the risky diffs, run a review pass and pick models per task so the token bill stays proportional to the work.
References
- Andrej Karpathy. Post on X introducing "vibe coding". February 2, 2025. Retrieved November 4, 2026 from x.com/karpathy/status/1886192184808149383
- Anthropic. Choose a permission mode (Claude Code documentation). Retrieved November 4, 2026 from code.claude.com/docs/en/permission-modes
- Veracode. 2025 GenAI Code Security Report (October 2025 update). Retrieved November 4, 2026 from veracode.com/resources/analyst-reports/2025-genai-code-security-report
- Anthropic. Extend Claude with skills: bundled skills. Retrieved November 4, 2026 from code.claude.com/docs/en/skills
- OpenAI. Reasoning models. Retrieved November 4, 2026 from developers.openai.com/api/docs/guides/reasoning
- Anthropic. Manage costs effectively (Claude Code documentation). Retrieved November 4, 2026 from code.claude.com/docs/en/costs
- OpenAI. GPT-6.1 Terra and GPT-6 Astra model pages. Retrieved November 4, 2026 from developers.openai.com/api/docs/models