The number that defines 2026

In February 2025, Andrej Karpathy — former AI Director at Tesla, co-founder of OpenAI — posted a casual observation about a new way of building software. He called it vibe coding: you describe what you want in natural language, the AI generates the code, and you resist the urge to understand every line of what it produced.

Eleven months later, Collins Dictionary named vibe coding its Word of the Year. By February 2026, Karpathy declared the term already passé, proposing something more structured in its place — agentic engineering, where AI handles implementation while humans provide architecture and review.

The speed of that arc — from blog post to Word of the Year to "passé" in under twelve months — tells you something about the pace at which AI is reshaping how software gets built.

The numbers behind it are remarkable. GitHub reports that 46% of all new code written today is AI-generated. Among Y Combinator's Winter 2025 cohort, 21% of startups have codebases that are 91% or more AI-produced. Gartner projects that 60% of all new code globally will be AI-generated by the end of 2026. Google says a quarter of its own code is already AI-assisted.

Here is the number those statistics don't lead with: developer trust in AI-generated code dropped from 77% in 2023 to 60% in 2026. Only 33% of developers trust AI code accuracy today, down from 43% two years ago. And yet usage keeps climbing.

The industry is hooked on something it doesn't trust. That is the state of vibe coding in 2026.

What vibe coding actually replaced

To understand why this matters, you have to understand what vibe coding replaced — and what it didn't.

Traditional coding is what software engineering has been for decades: a developer writes every line, understands every function, manages every dependency, and debugs every error. That process requires deep knowledge of data structures, algorithms, design patterns, and system architecture. It is slow, precise, and produces code that the person who wrote it can fully account for.

Vibe coding replaces the syntax part. The developer describes the desired outcome — the functionality, the user flow, the data structure — and the AI produces working code. The shift, as Karpathy put it, is that "the bottleneck moves from syntax to clarity of thought." You do not need to know how to write an authentication system in TypeScript. You need to know what a good authentication system does, and be able to describe it clearly enough for the AI to build one.

What vibe coding does not replace is judgment. When a traditional developer writes an authentication system, they think about token expiry, refresh flows, session management, rate limiting, and CSRF protection because they have been trained to think about those things. An AI might implement the happy path perfectly and miss three of those concerns unless specifically prompted. Stanford researchers ran a controlled experiment that found developers using AI tools wrote less secure code than those who didn't — while simultaneously reporting higher confidence in its security. The tools create a false sense of having solved the problem.

This is not a reason to avoid AI coding tools. 90% of developers regularly use at least one AI coding tool at work as of January 2026. The question is not whether to use them. The question is how to use them without losing the judgment that makes the output actually good.

The market built on a paradox

The commercial momentum behind vibe coding is extraordinary. Cursor — the dominant AI-powered code editor — surpassed $2 billion in annualised revenue in February 2026 and raised a Series D at a $29.3 billion valuation. Lovable reached $400 million ARR the same month, less than a year after launch. The vibe coding market as a whole is estimated at $4.7 billion in 2026, growing at a 38% compound annual rate.

That growth is being driven partly by a demographic shift that nobody predicted when the tools were first released. Sixty-three percent of active vibe coding users are not developers. Product managers, founders, designers, and domain experts are building full-stack applications using nothing but natural language. The non-developer adoption rate surged 520% year-over-year. Enterprise adoption of vibe coding platforms grew 340% between 2024 and early 2026. Eighty-seven percent of Fortune 500 companies are now running at least one vibe coding platform.

When the number of people who can create software grows from 30 million professional developers to potentially one billion people with good ideas and clear language, the downstream economic effects are genuinely difficult to overstate. That is the value thesis driving the extraordinary capital deployment into this category.

The risk thesis is sitting right next to it. CodeRabbit's analysis of 470 open-source GitHub pull requests found that AI-generated code has a 40% higher bug rate than human-written code. A separate Veracode analysis found that approximately 45% of AI-generated code contains security vulnerabilities — hardcoded secrets, improper input validation, or missing authentication checks. This is not a theoretical concern. In early 2026, a developer built a habit tracker using Claude and Cursor, achieved a fivefold increase in coding speed, and discovered that the AI had stored passwords in plain text and exposed API keys in the process.

The trust paradox, in its most practical form, is this: vibe coding dramatically lowers the cost of producing code, while simultaneously producing code that costs more to secure, audit, and maintain than traditional code does.

The second-order effects nobody predicted

The failures have attracted attention. But some of the most interesting consequences of vibe coding adoption in 2026 are the ones that surprised the people building the infrastructure it runs on.

Daniel Stenberg shut down cURL's six-year bug bounty program in January 2026. Not because of budget constraints. Because AI-generated vulnerability reports were flooding the program with noise at a volume that made it impossible for real security researchers to get through. Steve Ruiz went further: tldraw now automatically closes all external pull requests, not just AI-generated ones, because maintainers cannot distinguish real contributions from AI-generated noise fast enough to make individual review viable.

Tailwind CSS saw downloads climb while documentation traffic fell 40% and revenue dropped 80%. Developers are using the framework. They are just not reading the documentation — the AI reads it instead, sometimes incorrectly, generating code that works until it encounters an edge case that the documentation addresses and the AI's approximation does not.

RedMonk analyst Kate Holterhoff coined the term for this: "AI Slopageddon." The proliferation of AI-generated content — code, documentation, issue reports, pull requests — is degrading the signal-to-noise ratio of the open-source ecosystem in ways that are difficult to measure and harder to reverse.

What the hybrid approach actually looks like

The developers who are getting the most productive results from AI coding tools in 2026 are not the ones using them as a replacement for thinking. They are the ones using them as a multiplier on thinking they have already done.

Ben Marshall's ForexFlow project — a 200,000-line forex trading platform built in March 2026, spanning 840 TypeScript files across five sub-apps — is the most documented example of what disciplined AI integration looks like at scale. Marshall established 11 path-scoped rule files and 9 repeatable workflow templates to ensure architectural consistency across 195 commits. He used custom servers to provide live trading data and minimise AI errors in context-dependent decisions. His summary: "AI coding works when you build the system around it. Rules constrain. Hooks enforce. Skills keep workflows consistent."

This is not vibe coding as Karpathy originally described it — the pure natural language surrender to AI output. It is what the evolution of that practice looks like when it meets production reality: structured, constrained, reviewed, and governed.

The developers who will define what software engineering looks like in 2027 and beyond are not the ones who pick a side between AI and traditional coding. They are the ones developing judgment — the ability to look at a task and know whether to describe it to an AI or write it themselves, and how to verify the output either way.

That judgment is the new core skill. The tools change every quarter. The judgment is what compounds.

What comes next

The market signals are pointing in a clear direction. Agentic development — where AI agents handle not just code generation but testing, deployment, and iteration — is the next paradigm shift. IDC projects that 40% of G2000 job roles will involve working with AI agents by 2026, with a 10x increase in agent usage by 2027.

The trust problem will not be solved by better models alone. It will be solved by better infrastructure: testing frameworks that match the development approach, review processes that are as AI-native as the code they evaluate, and governance models that organisations actually implement rather than gesture toward.

The vibe coding adoption war is over. Everyone vibe codes now. The quality war — the question of what happens to all the code that was built fast without being built well — is just beginning. The differentiator this year is not whether your team uses AI tools. Every team does. The differentiator is whether you can tell the good output from the bad one before your users find out the difference.