Vibe coding is building software by describing what you want in natural language and letting an AI write the code — accepting, running, and iterating on its output rather than typing the code yourself. Andrej Karpathy coined the term in February 2025 ("fully give in to the vibes… forget that the code even exists"), Collins Dictionary named it a 2025 Word of the Year, and by 2026 it had become an industry: analysts size the vibe-coding tools market at roughly $4.7 billion, growing ~38% annually, with forecasts of $12B+ by 2027.
The numbers that define 2026
- 84% of developers globally use or plan to use AI coding tools (up from 76% in 2024); surveys of US developers put daily use above 90%.
- ~41% of all code is now AI-generated, and Gartner forecasts 60% of new code will be AI-generated by the end of 2026.
- 63% of vibe-coding users are non-developers — founders, marketers, analysts building tools they could never build before.
- 87% of Fortune 500 companies have adopted at least one AI-coding or vibe-coding platform.
In other words: this is no longer a niche workflow. It's how a large share of the world's software is getting written.
Vibe coding vs agentic coding: not the same thing
The terms get mixed up constantly. Vibe coding describes the posture — natural language in, working software out, minimal attention to the code itself. Agentic coding describes the machinery — an AI agent that plans, edits files, runs commands, and iterates toward a goal. You can vibe-code with a chat window and copy-paste; and you can use an agentic tool with full engineer-level scrutiny of every diff. The sweet spot for real projects is using agentic machinery under your vibe-level instructions — with the agent, not you, doing the verification. We unpack the machinery side in Inside the Plan–Act–Verify Loop.
The uncomfortable data: vibes ship vulnerabilities
The same 2026 research that documents the boom documents the bill:
- Veracode's analysis found 45% of AI-generated code contains OWASP Top 10 vulnerabilities; CodeRabbit measured a 2.74× higher vulnerability rate than human-written code.
- Sherlock Forensics' 2026 report found 92% of AI-generated codebases contain at least one critical vulnerability, with the average vibe-coded app carrying 8.3 exploitable findings.
- Escape.tech scanned 5,600 vibe-coded applications and found 2,000+ vulnerabilities, 400+ exposed secrets, and 175 instances of personal data sitting in the open.
- As of March 2026, researchers had linked 74 CVEs directly to AI-generated code.
- Meanwhile, only 29% of developers say they trust AI-generated code — they use it daily anyway.
None of this means vibe coding is a mistake. It means the missing ingredient is verification — which is exactly what the data-driven side of the industry is building. Our deep dive: Only 29% of Developers Trust AI Code. Verification Is How That Gets Fixed.
How to vibe-code without shipping the statistics above
- Use tools that verify with ground truth. An agent should run your tests, linter, and build and read the exit codes — not declare its own code correct. Cortex's loop engine treats "the model says it works" as inadmissible evidence.
- Keep a human gate where it matters. Approval modes (Cortex calls it ASK mode) let you review diffs on anything security-sensitive while letting routine work flow.
- Never let a tool hold your secrets loosely. API keys belong in OS-encrypted storage (Windows Credential Manager + DPAPI), not plaintext configs — one of the checks in our AI IDE buying guide.
- Watch the spend. Agentic iteration burns tokens; hard token/dollar budgets and cheap models for bulk work keep vibe coding cheaper than traditional development instead of surprisingly expensive. Numbers in our BYOK cost guide.
Where it goes next
If Gartner's 60% forecast holds, the interesting question stops being "should AI write code?" — it already does — and becomes "who checks it, and what does that cost?" The tools that win the next phase of vibe coding won't be the ones that generate fastest; they'll be the ones that let a solo builder ship software that survives a security scan. That's the bet Cortex is making: vibes in front, verified agentic loop underneath, on your own API keys.
Sources
- Taskade — State of Vibe Coding 2026: Market Size, Adoption & Trends
- FindSkill — Vibe Coding in 2026: $4.7B Market, 84% More Apps
- Hostinger — Vibe Coding Statistics 2026
- Sherlock Forensics — 2026 AI Code Security Report
- SQ Magazine — AI Coding Security Vulnerability Statistics 2026
- Vibe Coder Blog — The Security Crisis in AI-Generated Code in 2026