Vibe Coding 2026: AI App Builders, Real Numbers and Where They Fit in Business

In February 2025 Andrej Karpathy described a way of programming where you "forget that the code even exists". Less than two years later "vibe coding" is a Collins Word of the Year, Lovable is valued at $13.3 billion, and Anthropic reports that Claude Code alone runs at over $2.5 billion a year. At the same time, security audits keep finding a flaw in roughly nine out of ten vibe-coded apps. Both facts are true, and a company needs to plan for both.

What "vibe coding" means in 2026

Karpathy's original description was deliberately extreme: accept every change, don't read the diffs, paste error messages back until things work, and keep it to "throwaway weekend projects". The term then stretched to cover everything from that style to professional engineers steering coding agents. For a business it helps to separate three things:

• App builders such as Lovable, Replit, Bolt or v0: a browser chat that produces a running web app with hosting, a database and logins. Aimed at people who don't code.
• Coding agents such as Claude Code, OpenAI Codex and Mistral Vibe: agents that work in a real code repository, run tests and open pull requests. Aimed at developers, but increasingly used by technical non-developers. We covered them in our coding-agents guide.
• General agents such as Manus or Claude's artifacts: build a small app or website as one step of a wider task.

The tools are converging, but the question for each project stays the same: does anyone read and own the code that ships?

The market: the fastest revenue ramps in software

Lovable, a Stockholm company founded in 2023, is the reference case. It raised a $200 million Series A at a $1.8 billion valuation in July 2025, $330 million at $6.6 billion in December 2025, and $400 million at $13.3 billion in August 2026. At that point it said it hosted 60 million projects with 900 million monthly visitors combined.

Revenue moved just as fast. Lovable reported $100 million in annual recurring revenue in July 2025 and, according to Bloomberg, $200 million in November 2025; press reports put it at about $400 million in February 2026. On the coding-agent side, Anthropic wrote in its February 2026 funding announcement that Claude Code's run-rate revenue exceeded $2.5 billion, had more than doubled since the start of the year, and that an analysis estimated 4% of all public GitHub commits were authored by Claude Code.

OpenAI and Mistral report fewer figures. Codex now runs in ChatGPT, a CLI, IDE extensions and a desktop app; secondary sources cite about 5 million weekly users in June 2026, which OpenAI hasn't detailed on a page we could verify. Mistral released Mistral Vibe, an Apache-2.0 terminal agent, in December 2025 and called version 2.0 (January 2026) production-ready. It matters for European teams that want an EU vendor and open-weight models they can host themselves.

Who is building: developers are wary, non-developers are not

The Stack Overflow 2025 survey of professional developers shows the split. 84% use or plan to use AI tools, but only 60% view them favourably (down from 77% in 2023), and 46% distrust the accuracy of the output, up from 31% a year earlier. Nearly 77% said vibe coding is not part of their professional work.

Growth comes from elsewhere: founders, product managers, marketers and operations staff who could never commission software for a small problem. Y Combinator said in March 2025 that a quarter of its winter batch had codebases that were 95% AI-generated. Inside companies, the same pattern shows up as dozens of small tools that nobody in IT knows about, the software version of shadow AI.

The catch: security audits of vibe-coded apps

Every 2026 audit we found reports a majority of apps with at least one security problem, though the studies measure different things. An academic audit of 200 live apps (Deng et al.) confirmed 1,186 flaws, with at least one in 91% of the apps; 18.5% of the flaws were critical. A scan of 30,998 live apps by Reeve found something in 99% of them, mostly missing security headers, but the sharper result is that 57% of reachable Supabase-backed apps let anyone read database tables without logging in.

The typical failures aren't exotic: database rules left open, API keys in front-end code, no rate limiting, logins that only check on the client. They come from the way people work. The person prompting can't judge the code, and the model optimises for "it runs". We looked at the code-level data in more depth in our post on AI-generated code security.

Where vibe coding fits in a company

Our working map from client projects. The scores are our judgement, not survey data.

A five-step policy that works

1. Pick one approved builder and one coding agent, on company accounts with data-retention terms you have read. Personal accounts are where data leaks start.
2. Classify before building. Prototype, internal or customer-facing? Personal data or not? The answer decides who must review.
3. Graduate projects into a repository. A prototype that people start relying on moves to git, gets tests and an owner, and from then on is changed with a coding agent under review.
4. Scan everything that goes public: database access rules, secrets in the front end, authentication, rate limits. Many of the flaws above take minutes to find.
5. Train people on the review, not just the prompt. The skill that pays is spotting what the model didn't do. This is where we spend most of our workshop time with SMEs.

What this means for Croatian and DACH companies

For small and mid-sized companies the opportunity is real: a sales team can have its quote calculator, a warehouse its scanning helper, and a manager a working prototype to show a vendor, in a day instead of a quarter. The risk is just as concrete, because the same apps end up holding customer data under GDPR. Start with internal tools on non-sensitive data, put a developer in the loop for anything else, and treat the first successful prototype as the beginning of a software project, not the end.