Vibe coding is a way of building software in which a person describes what they want in everyday language and lets an artificial-intelligence model write, run and revise the code, accepting the output largely on how the finished product behaves rather than by reading every line. Founders, product managers and people with little programming background use it to produce prototypes, landing pages, internal tools and simple apps quickly, including in fintech.
The term was coined by the computer scientist Andrej Karpathy in a social media post in February 2025, and Collins Dictionary named it its Word of the Year for 2025. It sits at one end of a spectrum of AI-assisted programming. At the other end, professional engineers use the same tools but review, test and take responsibility for every change. The difference matters most where software touches money or personal data, because regulators, banks and auditors judge the system that results, not the method used to build it.
Vibe coding in plain terms
Imagine renovating a kitchen by describing it to a very fast builder: "bright, an island in the middle, lots of drawers." The builder produces something that looks right within an afternoon. You walk around it, ask for changes, and keep going until it feels right. You never inspect the wiring behind the walls.
That is vibe coding. It is excellent for seeing an idea take shape and for testing whether people want it. The trouble starts when the kitchen has to pass a safety inspection, hold up for years, or store other people's valuables. Then someone has to open the walls and check the wiring, and that part of the job is the same as it always was.
How vibe coding works
A typical session follows a loop. The user writes a prompt ("build a sign-up page that asks for name, email and country"), the AI tool generates code, runs it, and shows the result. The user reacts to what they see rather than to the code, and the tool edits the project in response. Modern tools can create whole projects, install libraries, connect to databases and deploy to hosting providers. Increasingly the tool itself behaves as an AI agent, planning several steps and running them without a prompt for each one.
The approach is fastest for work with a clear visual outcome and low stakes: a minimum viable product, a marketing site, a dashboard over existing data, or a demonstration for investors. It is weaker where correctness is invisible from the screen, such as rounding in an interest calculation, race conditions in a ledger, or permissions that only fail when an attacker tries them.
Where it fits in financial services
Payment and money-transfer businesses can use vibe coding to shorten early product work. A team might mock up a customer journey, a pricing calculator or a partner portal in days, then use it to test product market fit or to show a bank what it intends to build. It can also help non-engineers automate internal reporting.
Moving from that prototype to a live service is a different job. A system that onboards customers, holds balances or connects to a payment gateway must meet rules that sit outside the code generator's view:
- Identity checks. Know Your Customer (KYC) and sanctions screening must run in the right order and leave an audit trail.
- Authentication. Logins and payment approvals may need strong customer authentication or multi-factor authentication.
- Data protection. Personal identifiable information has to be stored, encrypted and deleted in line with laws such as the General Data Protection Regulation (GDPR).
- Integrations. Every application programming interface (API) key and webhook must be secured, rotated and monitored.
Many firms therefore pair prototypes with established infrastructure, licensing a white-label platform or buying software for a money transfer business instead of shipping AI-generated code straight to production.
Risks and limitations
The main risks come from code that works in a demonstration but has never been reviewed. Studies and security researchers have repeatedly found that AI-generated code can contain injection flaws, secrets written directly into files, outdated libraries and missing access checks. Because the author did not write the code, they may not know these weaknesses exist, and a later fix may break something elsewhere.
A vulnerable application can lead to a data breach or to fraud such as account takeover. Maintenance is a second problem: projects built through hundreds of prompts can become hard for any person to understand, which raises operational risk and makes due diligence by partners, acquirers and auditors slower.
Making AI-written software production-ready
Teams that use vibe coding responsibly treat the output as a first draft. Common practice is to keep the code in version control, require a human review of every change that touches money or data, run automated tests and dependency scanning, and apply security hardening before launch: removing default accounts, enforcing role-based access control, and switching on logging and alerting. Penetration testing by an independent party is usual before a regulated service goes live. Supervisors such as banking and payment regulators expect firms to show they understand and control their systems regardless of who, or what, wrote the code.