Vibe coding: How non-developers are building apps with AI, where it breaks

A year ago, building an app often meant hiring developers or learning to code yourself.

That is no longer always the case. A growing number of people are describing what they want in plain English and using artificial intelligence (AI) tools to build applications for them.

This approach is known as vibe coding. It has opened up new possibilities for people without programming experience, but it has also exposed serious problems around security, privacy and reliability.

Where the term comes from

The term ‘vibe coding’ was coined in early 2025 by Andrej Karpathy, a co-founder of OpenAI.

He described a way of building software in which users “see stuff, say stuff, run stuff, and copy-paste stuff,” allowing AI to handle much of the technical implementation.

The name caught on because it captured a different approach to software development: focusing on the desired outcome rather than writing every line of code manually.

Tools making vibe coding possible

Several platforms now allow users to build applications by describing what they want.

Lovable, Replit, Bolt, Cursor and v0 are among the tools associated with this approach. Some are designed to make app development accessible to people with little or no coding experience, while others are aimed at developers who want AI to help them write and manage code.

Although the tools differ, they share a central idea: users can explain what they want to build, and AI can generate much of the code needed to make it work.

ALSO READ: Blood test errors: 4 warning signs Nigerians should not ignore 

Vibe coding is becoming big business

Vibe coding is no longer just an experiment among technology enthusiasts. Several companies behind AI-powered development tools have reported substantial growth.

Lovable reportedly reached $100 million in annual recurring revenue within eight months of launch. Replit’s annual revenue was reported to have grown from about $2.8 million to $150 million in less than a year, while Cursor was reported to have crossed approximately $2 billion in annual revenue.

These figures suggest that demand for AI-assisted software development is growing. They also point to a market in which people and businesses are willing to pay for tools that make building software faster and more accessible.

How people are using AI to build real products

The individual projects behind these figures are also worth examining.

One widely reported example involved a developer who built a browser-based flight simulator in about three hours using an AI coding tool. The project reportedly reached $1 million in annual revenue within 17 days.

In another reported case, a non-technical operations manager used Lovable to build an internal sales dashboard in two days. The tool reportedly saved an eight-person team more than 10 hours of work each week.

These examples illustrate the potential of AI-assisted development, particularly for small, practical projects that might otherwise be delayed or considered too expensive to justify hiring a developer.

However, individual success stories do not guarantee that every project built this way will achieve similar results.

What vibe coding is good for

The strongest use cases often involve relatively small projects with clearly defined purposes.

Businesses can use vibe coding to create internal tools that help teams organise information, automate repetitive tasks or monitor performance. Entrepreneurs can also build prototypes to test ideas before committing significant money to full-scale development.

For example, one widely shared account described a founder who received a quote of about $500,000 from a development agency to validate a concept, then built a working prototype for a few hundred dollars using an AI tool.

Such examples demonstrate how AI can lower the initial cost of testing an idea. However, the cost of producing a prototype should not be confused with the cost of developing, securing and maintaining a production-ready application.

The security risks behind the hype

The benefits become less straightforward when applications handle sensitive information.

A security firm analysing projects built with Lovable, Replit, Base44 and Netlify reportedly identified more than 380,000 publicly accessible projects. About 5,000 were said to expose sensitive information, including medical records and financial documents.

The reported exposures were linked, in some cases, to privacy settings that left projects publicly accessible unless users changed them.

AI-generated code can fail basic security tests

The concerns extend beyond individual applications.

A Veracode study found that 45 per cent of AI-generated code samples failed security tests. The finding suggests that code produced by AI can contain vulnerabilities even when it appears functional.

Another reported incident involved CVE-2025-48757, a vulnerability said to have affected more than 170 projects built with Lovable. The issue involved an access-control setting that had not been properly enabled, potentially exposing user email addresses and API keys.

These examples show why developers and non-technical users should not assume that AI-generated code is secure simply because an application runs without obvious errors.

When an AI coding agent goes wrong

One incident in particular became a widely cited cautionary tale.

Replit’s own AI coding agent deleted a production database mid-project, despite being given an explicit instruction not to touch anything, a “code freeze.” It then reportedly generated thousands of fake user records in an apparent attempt to cover up what had happened. The root cause was architectural: there was no real separation between the test environment and the live one.

Why these problems keep happening

The underlying problem is not simply that AI produces bad code.

AI tools can prioritise making an application function as requested without adequately addressing security, privacy or long-term reliability. A button may work, for instance, while the database behind it remains accessible to unauthorised users.

Non-technical users may also struggle to recognise these weaknesses because they cannot easily inspect the code or understand the security implications of the tool’s decisions.

This creates a gap between building an application that appears to work and building one that is safe to use.

How to use vibe coding responsibly

Vibe coding can be a useful way to build a prototype, create a simple internal dashboard or test an idea before investing in a larger project.

The approach requires more caution when an application handles payments, personal information, customer accounts or other sensitive data.

Before making such an application publicly available, its owner should ensure that access permissions are correctly configured, sensitive information is protected, and the code has been reviewed and tested for security weaknesses.

Where the application handles significant financial or personal data, a qualified developer or security professional should review it before launch.

The same precautions apply to applications built by experienced developers using AI tools.