Vibe Coding: What It Is, Risks and Security in 2026 – A UK Guide

Vibe coding is the fastest way to write software today – and also the most dangerous when done on the fly. The term, coined in 2025, describes a programming style where you describe your intent in natural language and let the AI generate, refine, and debug the code for you. By 2026, it has moved from Twitter into banks, startups, and even trading systems. In this guide, I separate hype from reality: adoption, tools, documented security risks, and how to use it without getting burned.

TL;DR

• Vibe coding is intention-driven programming: you talk to the AI and it writes the code, instead of typing line by line.
• Adoption has exploded: AI already generates 46% of all new code on GitHub in 2026, with projections of 60% by year-end.
• The risk is concrete: studies from Q1 2026 show that 40% to 62% of AI-generated code contains vulnerabilities.
• The problem isn't the tool – it's the process: most developers don't review what the AI delivers before pushing to production.
• You can use it well – with review, testing, limited scope, and the right safeguards.

What is vibe coding (and where the term came from)

The term vibe coding was coined by Andrej Karpathy, former AI director at Tesla and co-founder of OpenAI, on 2 February 2025 in an X post that garnered over 4.5 million views. The phrase that stuck was direct: "fully give in to the vibes, embrace the exponentials, and forget that the code even exists."

In practice, vibe coding is programming by conversation. Instead of writing every function by hand, you describe what you want – "create a login screen with password recovery" – and an AI assistant generates the code, adjusts based on your feedback, and corrects its own errors. Karpathy described the flow using Cursor's Composer with Anthropic models, programming by voice, barely touching the keyboard.

The term stuck so well that Collins Dictionary named "vibe coding" one of the words of the year for 2025. But it's important to separate two things that are often confused: pure vibe coding (accepting what the AI generates without reading it) is different from AI-assisted coding (using AI with active human review). That distinction, as you'll see, is exactly the line between productivity and disaster.

How vibe coding exploded in 2026

In just over a year, vibe coding has gone from weekend experiment to business infrastructure. The numbers make this clear:

• AI is already responsible for 46% of all new code on GitHub in 2026, with projections of reaching 60% by year-end.
• Around 40% of new SaaS MVPs are built primarily with vibe coding.
• 25% of startups from Y Combinator's Winter 2025 batch run on codebases that are 95% AI-generated.
• Cursor, one of the leading tools, reached $2 billion in annualised revenue at the start of 2026.

It's not just startups. In May 2026, Bloomberg reported that Dutch bank ING is using vibe coding to build electronic FX and credit trading tools. The same month, Lovable invested in a Danish hardware startup, Atech, which aims to bring vibe coding to the physical world: you buy a kit, describe the prototype to a chatbot, and receive the finished code.

As a full-stack developer with over 15 years' experience, I see this with both feet on the ground. The speed is real – prototypes that used to take a week now come together in an afternoon. But speed without discipline, in software, has a name: technical debt compounding interest.

The tools dominating vibe coding

The ecosystem has organised around two tool profiles. Understanding the difference helps you choose the right one for each stage.

Tool	Profile	Best for
Lovable / Bolt	Browser-based generators	Rapid prototyping, idea validation, landing pages
Cursor / Claude Code	Agentic IDEs	Production code, refinement, large codebases
GitHub Copilot	Integrated assistant	Contextual autocomplete in daily work
v0 / Replit Agent	UI and app generation	Interfaces and full-stack apps guided by prompts

A workflow that gained traction in 2026 is what they call the "graduate workflow": you start prototyping in a browser-based tool like Bolt or Lovable, and once the idea is proven, you migrate the code to an agentic IDE like Cursor or Claude Code to refine it to production level. This same move towards agentic IDEs I detailed in the post about Google Antigravity 2.0, which shows how Google entered this fray.

The point almost no tutorial mentions: the tool doesn't absolve you from knowing what's happening. It accelerates those who know and hides the pitfalls from those who don't.

The dark side: security risks of vibe coding

Here's the part that enthusiasm usually sweeps under the rug. When you accept code without reading it, you also accept the flaws that come with it – and they do come.

Georgia Tech launched the Vibe Security Radar in 2026, after realising nobody was tracking vulnerabilities introduced by AI tools. In March 2026 alone, the radar recorded 35 new CVE entries directly caused by AI-generated code – more than in all of 2025 combined, and a jump from the 6 in January.

Studies from Q1 2026 are consistent and uncomfortable:

• Between 40% and 62% of AI-generated code contains security vulnerabilities.
• AI-written code produces flaws at a rate 2.74 times higher than human code.
• XSS (cross-site scripting) vulnerabilities appeared in 86% of samples of AI code tested across five different LLMs.
• A meta-analysis from January 2026, covering 78 studies on agentic code assistants, found attack success rates above 85% when adaptive strategies are used – and most published defences block less than 50% of these attacks.

This ties directly into other supply chain threats we've covered, such as the Shai-Hulud infected NPM packages: AI-generated code often pulls in dependencies without checking their provenance, widening the supply chain attack surface.

The "trust paradox" of AI-generated code

The most revealing data point of 2026 isn't about the AI – it's about us. There's a dangerous mismatch between what developers believe and what they do.

Industry surveys show that 96% of developers do not fully trust that AI-generated code is functionally correct. 61% agree that AI produces code that looks right but isn't reliable. And yet only 48% always review the code before committing. In other words: most know the code might be wrong, yet more than half don't always check.

Why does this happen? Because 82% of that same group say AI helps them code faster. Speed trumps prudence. It's the classic psychological shortcut: when something looks ready and the deadline is tight, the brain treats review as a cost, not a safety net.

That's the core problem with vibe coding. It's not that AI is incompetent – it's that it's convincing. Code that compiles and runs on the demo screen can hide an SQL injection, an exposed API key, or an authorisation flaw that only appears when someone malicious goes looking.

When to use vibe coding (and when NOT to)

Vibe coding is neither good nor bad – it's a tool with right and wrong contexts. After applying it in real client projects, here's my honest yardstick.

Use vibe coding without fear when:

• You're prototyping to validate an idea that might be discarded.
• The project is internal, with no sensitive data and no public exposure.
• You master the domain and can review what the AI delivers.
• It's a one-off script, a simple automation, or a UI draft.

Avoid pure vibe coding when:

• The system handles payments, personal data (UK GDPR / Data Protection Act 2018), or authentication.
• The code goes to production without a human review step.
• No one on the team deeply understands what was generated.
• The codebase is large and a poorly understood change could break dependencies.

The rule of thumb: the higher the cost of a mistake, the less "vibe" and the more rigour you need. Trading, healthcare, and finance don't mix with "forget the code exists."

How to do vibe coding safely: a practical checklist

You can reap the speed of vibe coding without inheriting the security liability. The secret is to treat the AI as a brilliant but rushed junior developer – one that needs supervision. Here's the process I follow:

1. Specify before generating. A vague prompt yields vague code. Describe requirements, constraints, and edge cases. The better the brief, the better the result.
2. Read everything that goes to production. Don't commit what you don't understand. If you don't understand, ask the AI to explain – and be suspicious if the explanation is evasive.
3. Run static analysis and SAST. Automated tools catch injections, exposed secrets, and insecure patterns before deployment.
4. Write (or ask for) real tests. Test coverage is the best antidote to "looks like it works."
5. Audit dependencies. Check every package the AI imports. Invented or compromised libraries are a real attack vector.
6. Limit the scope of each interaction. Small, reviewable changes beat large refactorings that the AI does in one go and nobody can audit.
7. Never expose secrets in the prompt. Keys, tokens, and credentials don't go into the conversation with the AI.

This care for the software supply chain isn't paranoia: we've already seen cases like the GitHub breach via a malicious VS Code extension, where blind trust in the ecosystem cost dearly.

The future of vibe coding and the developer's role

The question I hear most often is whether vibe coding will kill the programming profession. My take, after watching this movement closely, is the opposite: it raises the bar for what it means to be a developer.

What loses value is typing – writing boilerplate, configuring the trivial, remembering syntax. What gains value is what AI still doesn't do well: architecture, security judgement, business understanding, the ability to critically review and say "this is wrong and here's why." The developer becomes less a typist and more a reviewer, architect, and final responsible party.

It's the same logic as the AI agents arriving in enterprises: they automate execution, but someone needs to define the goal, validate the outcome, and bear the consequences. The AI doesn't take responsibility – you do.

Vibe coding is a powerful lever. Like any lever, it multiplies force in both directions: the well-done work and the mistake. Those who use it with discernment will deliver more and better. Those who use it on the fly will discover, the hard way, why the 96% don't fully trust it.

Conclusion: speed with responsibility

Vibe coding is the biggest change in how we program in a decade, and it's not going back – in 2026 it's already mainstream, from startups to banks. But the same numbers that show adoption also show risk: code too fast to be reliable when nobody reviews it. The good news is that productivity and security aren't enemies; they just need process.

If your company is considering adopting vibe coding or putting AI into the development flow without opening gaps, it's worth talking to someone who's done it in practice. At Agathas Web, we combine the speed of new stacks with the rigour of those who've kept critical systems running for over 15 years.