Primary source

There's a new kind of coding I call 'vibe coding', where you fully give in to the vibes, embrace exponentials, and forget that the code even exists.

— Andrej Karpathy, 2 Feb 2025 (quoted via MIT Technology Review / Fowler)

Karpathy — the coinage tweet

The originating X post is the primary definition used everywhere else: fully give in to the vibes, forget the code exists, see/say/run/copy-paste. Claude Code practitioners need this line so they know when they have left vibe-coding and entered reviewed agentic work.

STRONG · 2025 · Andrej Karpathy

Vibe coding

Beginner

The coinage tweet and the official Claude Code surface.

24 articles · 2 categories

Medium

Skills, MCP, context, and the other IDEs.

48 articles · 4 categories

Profi

Loops, review, team practice, and shipped cases.

46 articles · 4 categories

118 of 118

Beginner · Origin & definition

This SE/HCI paper defines vibe coding as collaborative flow that shifts intent mediation from deterministic instruction to probabilistic inference, and lists black-box codebases and responsibility gaps as risks.

STRONG · 2025 · Meske, Hermanns, von der Weiden, Loser, Berger

Beginner · Origin & definition

Instead of a binary good/bad, Böckeler uses probability × impact × detectability to decide whether skipping review is acceptable. Low-stakes prototypes may be true vibes; high-impact low-detectability work needs review.

STRONG · 2025 · Birgitta Böckeler

Beginner · Origin & definition

Collins’ own WOTY page, not Wikipedia: vibe coding is named Word of the Year 2025 as natural-language-to-code via AI, popularised by Karpathy’s “forget that the code even exists.” Lexical lock for the corpus.

STRONG · 2025 · Collins Dictionary

Beginner · Origin & definition

IBM dates the term to Karpathy (February 2025) and frames vibe coding as intent-driven generation rather than a full SDLC. The piece is explicit that production still needs planning, tests, security, and governance — the gap Claude Code harnesses try to close.

MODERATE · 2025 · Shalini Harkar / IBM

Beginner · Origin & definition

Fruhlinger quotes Karpathy and then industry voices who treat vibe coding as inversion of control: you describe outcomes, the model writes the app. Useful as the popular-press version of the same split Fowler draws more carefully.

MODERATE · 2025 · Josh Fruhlinger

Beginner · Origin & definition

The originating X post is the primary definition used everywhere else: fully give in to the vibes, forget the code exists, see/say/run/copy-paste. Claude Code practitioners need this line so they know when they have left vibe-coding and entered reviewed agentic work.

STRONG · 2025 · Andrej Karpathy

Beginner · Origin & definition

Fowler keeps Karpathy’s strict sense: you do not look at the generated code. He names the reviewed-LLM workflow “Agentic Programming” and warns that semantic diffusion has collapsed the two. For Claude Code this is the vocabulary split between disposable vibes and harnessed agent work.

STRONG · 2026 · Martin Fowler

Beginner · Origin & definition

The dictionary entry is the lexical proof that the meme left Twitter: vibe coding means telling an AI what you want and letting it create the product, without needing to understand how the code works.

STRONG · 2025 · Merriam-Webster

Beginner · Origin & definition

MIT TR reprints Karpathy’s February post and stresses the surrender test: accepting suggestions, pasting errors with no comment. It also quotes MIT Media Lab’s Tobin South: vibe coding is having a vision you cannot execute, but AI can.

MODERATE · 2025 · MIT Technology Review

Beginner · Origin & definition

Wikipedia’s missing primary: Roose (27 Feb 2025) popularizes Karpathy’s term for non-programmers building “software for one” in Cursor, Replit, Bolt, and Lovable. He still wants a human nearby and treats it as hobby-scale, not production SDLC.

STRONG · 2025 · Kevin Roose

Beginner · Origin & definition

A year after the LunchBox Buddy column, The Daily names Claude Code as the vibecoding tool that could change software work. This is the mass-media join of Karpathy’s slang to Anthropic’s agent CLI.

MODERATE · 2026 · Kevin Roose / The Daily

Beginner · Origin & definition

Böckeler names semantic diffusion as the reason “vibe coding” now means both Karpathy’s forget-the-code hobby and IDE agent modes. She dates the tweet to 2 February and contrasts unsupervised vibes with supervised sessions.

MODERATE · 2025 · Birgitta Böckeler, Lilly Ryan, Neal Ford

Beginner · Origin & definition

Wikipedia records that Andrej Karpathy coined “vibe coding” in February 2025 and that Merriam-Webster and Collins later treated the phrase as trending slang / word of the year. It also preserves Simon Willison’s cut: reviewed LLM code is not vibe coding.

STRONG · 2025 · Wikipedia contributors

Beginner · Claude Code docs

Enterprise pattern: agentic search over live files beats stale RAG indexes in monorepos. Navigation quality depends on CLAUDE.md and skills. Directly relevant when vibe-coding inside a million-line tree.

STRONG · 2026 · Anthropic

Beginner · Claude Code docs

Users approve 93% of permission prompts; `--dangerously-skip-permissions` is the unsafe escape. Auto mode inserts classifiers plus an injection probe so sessions can skip clicks without skipping safety. Incident log includes git-branch deletion and token upload.

STRONG · 2026 · Anthropic

Beginner · Claude Code docs

Anthropic’s practice note: describe what you want and let Claude explore/plan/implement, but close the loop with a check Claude can run. Context-window fill is named as the main resource to manage — the anti-vibe of “just keep chatting.”

STRONG · 2026 · Anthropic

Beginner · Claude Code docs

Versioned release notes generated from GitHub CHANGELOG.md: Opus 5 default, nested subagents to depth 3, DirectoryAdded hook, Dynamic workflow size guideline, auto-mode classifier taking more permission decisions. The missing first-class changelog article.

STRONG · 2026 · Anthropic

Beginner · Claude Code docs

Operator map: interactive `claude`, headless `-p`, continue `-c`, resume `-r`, `claude agents` for parallel background sessions, gateway, auto-mode, and auth. Vibe loops that never leave chat miss these flags.

STRONG · 2026 · Anthropic

Beginner · Claude Code docs

Documents the agentic loop as gather context → take action → verify, powered by models plus tools. Claude Code is explicitly the harness around Claude: tools, context management, execution environment.

STRONG · 2026 · Anthropic

Beginner · Claude Code docs

Official overview: Claude Code is an agentic coding tool that reads the codebase, edits files, runs commands, and ships on terminal, IDE, desktop, and browser. Native install is recommended over deprecated npm.

STRONG · 2026 · Anthropic

Beginner · Claude Code docs

The quickstart is the on-ramp: install, `claude --version`, log in, then common tasks. It lists web, desktop, VS Code, JetBrains, Slack, and GitHub Actions as first-class surfaces besides the terminal.

STRONG · 2026 · Anthropic

Beginner · Claude Code docs

Marketing surface that still states the job: work with Claude in the codebase from terminal, IDE, Slack, web, GitHub, VS Code, JetBrains, iOS, Android. Pricing bands (Pro / Max) sit here.

STRONG · 2026 · Anthropic

Beginner · Claude Code docs

Public product repo: terminal agent, git workflows, plugins, Discord, data-usage pointer. Native installers replace npm. Canonical GitHub home for Claude Code itself.

STRONG · 2025 · Anthropic

Beginner · Claude Code docs

Interview with founding engineers: TypeScript/React/Ink/Bun stack, ~90% of Claude Code written by itself, ~5 releases per engineer per day, subagents built in three days. The product is an AI-first team’s dogfood.

MODERATE · 2025 · Gergely Orosz, Boris Cherny, Sid Bidasaria, Cat Wu

Medium · CLAUDE.md · skills · hooks

Decision table for seven instruction channels: when they load, compaction behavior, context cost. Root CLAUDE.md is high-cost always-on; skills are low-cost until invoked; hooks bypass compaction.

STRONG · 2026 · Anthropic

Medium · CLAUDE.md · skills · hooks

Skills as folders with progressive disclosure: name/description always in the prompt, body loaded when relevant, extra files on demand. Published as a cross-tool open standard (Dec 2025).

STRONG · 2025 · Anthropic

Medium · CLAUDE.md · skills · hooks

Two memory systems: you-written CLAUDE.md and Claude-written auto memory. Both load every session as context, not enforcement — hard blocks belong in PreToolUse hooks. Load order covers managed policy, user, project, and local files.

STRONG · 2026 · Anthropic

Medium · CLAUDE.md · skills · hooks

Dedicated path-scoped-rules primary: put topic files under `.claude/rules/`, optionally YAML `paths:` globs so they load only when matching files are read. Target under 200 lines per CLAUDE.md; bloated always-on files lose adherence.

STRONG · 2026 · Anthropic

Medium · CLAUDE.md · skills · hooks

Hooks are user-defined shell commands at lifecycle points — deterministic, not “Claude might remember.” Notification, PostToolUse formatters, PreToolUse blocks. This is the enforcement plane vibe coding otherwise lacks.

STRONG · 2026 · Anthropic

Medium · CLAUDE.md · skills · hooks

Skills are SKILL.md folders that load on demand (unlike always-on CLAUDE.md). Custom commands merged into skills. Bundled skills include /doctor, /code-review, /debug, /loop. This is the official way to stop pasting the same procedure into a vibe chat.

STRONG · 2026 · Anthropic

Medium · CLAUDE.md · skills · hooks

Official explorer of every on-disk instruction surface: CLAUDE.md, `.claude/rules/` (topic-scoped, optionally path-gated), settings, hooks, skills, agents, workflows, MCP, auto memory. Tips on the page: keep CLAUDE.md under 200 lines and move task-only law to a skill or path-scoped rule.

STRONG · 2026 · Anthropic

Medium · CLAUDE.md · skills · hooks

Practitioner guide matching official memory docs: project vs ~/.claude vs CLAUDE.local.md, ~200-line budget, path-scoped rules, auto memory since v2.1.59, hooks for must-hold rules.

MODERATE · 2026 · Neo Zino

Medium · CLAUDE.md · skills · hooks

A single CLAUDE.md distilled from Karpathy’s complaints: models assume, overcomplicate, and edit orthogonal comments. Four principles (think, simplicity, surgical, goal-driven) aimed at Claude Code sessions.

MODERATE · 2026 · forrestchang / Multica

Medium · CLAUDE.md · skills · hooks

Public skill examples (docx/pdf/pptx/xlsx plus community patterns). Points at agentskills.io for the standard. Clone this before inventing a skill layout.

STRONG · 2025 · Anthropic

Medium · CLAUDE.md · skills · hooks

Practice note: CLAUDE.md onboards a stateless model (WHAT/WHY/HOW). Warns that Claude Code injects a system reminder that the file “may or may not be relevant,” so bloated files get ignored.

MODERATE · 2025 · Kyle / HumanLayer

Medium · CLAUDE.md · skills · hooks

Load-order diagram (managed → user → project → local) plus the same context-not-enforcement warning. Complements official docs with a 2026 model lineup note.

MODERATE · 2026 · Using Claude

Medium · MCP & tools

Official plugin marketplace (internal + external). Trust warning: Anthropic does not control MCP servers inside community plugins. Install via `/plugin`. This is how vibe sessions add tools without pasting JSON from a tweet.

STRONG · 2025 · Anthropic

Medium · MCP & tools

Curated production list that treats MCP servers as first-class: reference servers, Context7, Playwright MCP, plus CLAUDE.md templates and safety guards. Explicitly not chatbot toys.

MODERATE · 2026 · sergeykrin9

Medium · MCP & tools

CLI surface including piping content into `claude -p`, resume by name, auth, and agent-view flags. Tool and MCP config flags belong in the same operator map.

STRONG · 2026 · Anthropic

Medium · MCP & tools

Headless `-p` is how you script Claude Code in CI: `--allowedTools`, `--bare` skipping hooks/skills/MCP/CLAUDE.md discovery for reproducible machines.

STRONG · 2026 · Anthropic

Medium · MCP & tools

Official MCP page: connect issue trackers, Sentry, Postgres, Figma, Slack; `claude mcp add`; prompt-injection warning; mcp-server-dev plugin to scaffold servers. This is how a vibe session stops being a paste-buffer.

STRONG · 2026 · Anthropic

Medium · MCP & tools

Official GitHub Action: @claude on PRs/issues, reviews, implementations, Bedrock/Vertex/Foundry auth. CI twin of the local vibe loop, tools gated by workflow config.

STRONG · 2025 · Anthropic

Medium · MCP & tools

Docs-lookup MCP/CLI that injects current library docs into the prompt so agents stop inventing APIs from training-cutoffs. Ships CLI+Skills and MCP modes, including a Claude plugin folder.

STRONG · 2025 · Upstash

Medium · MCP & tools

Hand-picked catalog of Claude Code skills, agents, status lines, plugins, and developer tooling. The discovery surface for MCP-adjacent extensions the official docs do not list.

MODERATE · 2025 · hesreallyhim

Medium · MCP & tools

Top-level protocol site: open-source standard for connecting AI apps to files, databases, tools, and workflows. Pair with Claude Code’s `claude mcp add` page.

STRONG · 2025 · Model Context Protocol

Medium · MCP & tools

The `/quickstart/user` page is a Claude Desktop filesystem-server walkthrough: Node.js, explicit per-action approval, then tools to read, create, move, and search files. It is not the Figma enablement list; that lives on the protocol intro. Claude Code users still use the same local-server mental model via `claude mcp add`.

STRONG · 2025 · Model Context Protocol

Medium · MCP & tools

Protocol home: USB-C metaphor, Claude Code generating an app from Figma called out as a canonical enablement. Standard that Cursor, VS Code, and ChatGPT also speak.

STRONG · 2025 · Model Context Protocol

Medium · MCP & tools

Official Playwright MCP server: LLMs drive pages via accessibility snapshots, not screenshots. Documents `claude mcp add playwright npx @playwright/mcp@latest` as the Claude Code install. Turns a vibe session into an agent that can click, fill, and assert a running UI.

STRONG · 2025 · Microsoft

Medium · Context & prompting

A README-for-agents standard used by 60k+ projects. Codex, Cursor, Aider, Copilot, Windsurf, and others read AGENTS.md. Complements CLAUDE.md rather than replacing a human README.

STRONG · 2025 · AGENTS.md

Medium · Context & prompting

Primer on coding-agent context: instructions vs guidance, tools as context interfaces. Claude Code is named as leading the feature race. Context engineering = curating what the model sees.

STRONG · 2026 · Birgitta Böckeler

Medium · Context & prompting

Migration note: renaming CLAUDE.md to AGENTS.md is not equivalent. Hooks and managed settings can become merely advisory. Nested scope and MCP/skill wrappers need a second-pass audit.

MODERATE · 2026 · Bring Your AI

Medium · Context & prompting

Interactive + written contract for what fills a Claude Code session: CLAUDE.md and skill descriptions load before you type; path-scoped rules load with matching files; `/compact` re-injects project-root CLAUDE.md and unscoped rules from disk, while `paths:` rules stay lost until a matching file is read again. This is why a 200-line CLAUDE.md is the measured budget, not folklore.

STRONG · 2026 · Anthropic

Medium · Context & prompting

Treats CLAUDE.md, memory, rules, hooks, permissions, skills, and subagents as engineering configuration, not optional prompts. Maps each kind of guidance to a home so the root file is not overloaded.

MODERATE · 2026 · Data Studios

Medium · Context & prompting

CLI and template catalog (aitmpl.com) for configuring and monitoring Claude Code. A packaged way to install context/skills rather than hand-rolling every CLAUDE.md.

MODERATE · 2025 · davila7

Medium · Context & prompting

Large open guide (430K+ lines claimed) covering agentic workflows, hooks, skills, MCP, quizzes, templates. Tagged vibe-coding. Website cc.bruniaux.com is the reading UI.

MODERATE · 2026 · Florian Bruniaux

Medium · Context & prompting

Product from the context-engineering crowd: tasks, artifacts, worktrees, Claude+Codex subscriptions. Aimed at million-LOC codebases, not toy vibes.

MODERATE · 2026 · HumanLayer

Medium · Context & prompting

Names the context gap, context drift, and hierarchical CLAUDE.md/AGENTS.md architecture for monorepos. Argues prompt engineering is the wrong layer once the repo is large.

MODERATE · 2026 · Laurent Py / Packmind

Medium · Context & prompting

Horthy is credited here with coining “context engineering.” Covers harness/loop engineering, 12-factor agents, and shipping in complex codebases without sacrificing quality.

MODERATE · 2026 · Gergely Orosz, Dex Horthy

Medium · Context & prompting

Survey of coexisting context files: CLAUDE.md, AGENTS.md, .cursorrules, Copilot instructions, skills, subagents, hooks, MCP. Thesis: agents take the shape of the environment you build.

WEAK · 2026 · Youngju Kim

Medium · Peers & IDEs

Ranks Claude Code as most capable for serious engineering, Codex for prototyping/cloud, Cursor if you refuse to leave the IDE, Aider as CLI. States every agent is a front-end for a frontier model plus a loop.

MODERATE · 2026 · Admix

Medium · Peers & IDEs

Product site: pair-program in the terminal, repo map, git commits, lint/test loop, voice-to-code, Claude 3.7 called out as a best model. The polished peer to Claude Code’s CLI.

STRONG · 2026 · Aider

Medium · Peers & IDEs

Cursor’s MCP page: same protocol Claude Code uses, stdio/SSE/HTTP transports, marketplace. Shared infrastructure; different product shape (IDE fork vs terminal harness).

STRONG · 2026 · Cursor

Medium · Peers & IDEs

Official rename: Devin Desktop is the new name for Windsurf. One surface for local and cloud agents (Devin Local, Cloud, Codex, Claude Agent, OpenCode, Cascade). The missing Windsurf/Devin primary.

STRONG · 2026 · Cognition / Devin

Medium · Peers & IDEs

Cascade is Devin Desktop’s local agentic assistant (Code/Chat, tools, voice, checkpoints, linter). Distinct from the Devin Local agent new tabs default to. Workflows and skills still live under `.windsurf/` paths.

STRONG · 2026 · Cognition / Devin

Medium · Peers & IDEs

Terminal pair-programmer with repo map, auto-commits, local+cloud LLMs. Explicitly lists Claude models. The git-native CLI peer Claude Code is most often compared with.

STRONG · 2023 · Paul Gauthier / Aider

Medium · Peers & IDEs

OpenAI’s local coding-agent CLI (install via chatgpt.com/codex/install.sh, brew, or npm). Direct peer to `claude` on the command line; AGENTS.md is its instruction file.

STRONG · 2025 · OpenAI

Medium · Peers & IDEs

Industry survey piece: vibe coding as iterative prompting for full-stack apps; experts (e.g. New Relic) analogize to compilers, not the end of developers. Names Replit-class demos alongside the broader AI-SDLC shift Claude Code sits in.

MODERATE · 2025 · Isaac Sacolick

Medium · Peers & IDEs

Enterprise 2026 roundup: Copilot as Microsoft default, Cursor for multi-file, Claude Code for hard problems / SWE-bench. Mentions METR RCT slowdown vs perceived speedup.

WEAK · 2026 · Kanerika Inc

Medium · Peers & IDEs

RCT primary Kanerika only cited: 16 experienced OSS developers, 246 real issues, mainly Cursor Pro + Claude 3.5/3.7 Sonnet. AI-allowed tasks took 19% longer; developers still believed they were 20% faster. Snapshot of early-2025, not a claim about Claude Code 2026.

STRONG · 2025 · Joel Becker, Nate Rush, Beth Barnes, David Rein

Medium · Peers & IDEs

JetBrains 2025: 85% use AI tools; 59% run three or more in parallel. Copilot for boilerplate, Claude Code for complex refactors, Cursor for multi-file. Covers nine tools including Windsurf, Codex, Cline, Aider.

MODERATE · 2026 · Paperclipped

Medium · Peers & IDEs

Five-way 2026 comparison: Copilot as layer, Cursor as VS Code fork, Claude Code as terminal-native agent, Windsurf/Devin Desktop as parallel IDE, Grok Build as CLI.

MODERATE · 2026 · Florent Clairambault

Medium · Peers & IDEs

Timeline from Copilot autocomplete (2021) to Claude Code CLI (Feb 2025) and Codex CLI (Apr 2025). Places Aider as git-native CLI and Claude Code as Anthropic’s official CLI agent.

MODERATE · 2026 · Youngju Kim

Profi · Loops & orchestration

Across context windows agents one-shot too much or declare victory early. Fix: initializer agent plus coding agent that leaves mergeable artifacts. Compaction is not enough. Directly about Claude Agent SDK loops.

STRONG · 2025 · Anthropic

Profi · Loops & orchestration

Product announcement: Claude writes orchestration scripts that run tens to hundreds of parallel subagents and checks work before it reaches you. Pairs with auto mode and `ultracode` effort. Token-heavy.

STRONG · 2026 · Anthropic

Profi · Loops & orchestration

Compilation of Cherny’s 2026 threads: 5 local sessions + 5–10 web sessions, git worktrees, plan mode then auto-accept, living CLAUDE.md, Opus with thinking. “Surprisingly vanilla” setup.

MODERATE · 2026 · Anup Jadhav / Boris Cherny

Profi · Loops & orchestration

Scripted `query()` agents are the same filesystem harness as the CLI: omit settingSources and you load user/project/local settings, CLAUDE.md, and `.claude/` skills/agents/commands; pass `[]` for a bare machine. This is the JSON/SDK form of a vibe loop, not a second product.

STRONG · 2026 · Anthropic

Profi · Loops & orchestration

Subagents run in their own context with custom prompts, tools, and permissions, returning a summary so the main vibe session is not flooded. Built-in Explore is read-only; Plan/Explore skip CLAUDE.md for cheap research.

STRONG · 2026 · Anthropic

Profi · Loops & orchestration

A dynamic workflow is a JavaScript script that orchestrates dozens-to-hundreds of subagents. The plan lives in code, not the context window. `/deep-research` is the bundled example. Requires v2.1.154+.

STRONG · 2026 · Anthropic

Profi · Loops & orchestration

Compares subagents, agent view, agent teams, and dynamic workflows. Worktrees isolate file edits. Parallelism multiplies tokens. This is the official map of Claude Code’s orchestration surfaces.

STRONG · 2026 · Anthropic

Profi · Loops & orchestration

Git worktrees isolate parallel sessions so two vibe agents do not edit the same files. `claude --worktree name` creates `.claude/worktrees/`. Desktop app auto-worktrees. `.worktreeinclude` copies .env.

STRONG · 2026 · Anthropic

Profi · Loops & orchestration

Skills framework that forces spec → design chunks → TDD plan → subagent-driven development. Agents can run autonomously for hours without leaving the plan. Methodology for Claude Code (and other hosts).

MODERATE · 2025 · Jesse Vincent (obra)

Profi · Loops & orchestration

Tracks Claude Code’s many system prompts (not one string): Plan/Explore/Task subagents, CLAUDE.md injection, compact, security review. Changelog across 276 versions. Lets you see how the loop is actually prompted.

MODERATE · 2025 · Piebald-AI

Profi · Loops & orchestration

Secondary compilation of Cherny doctrine: vanilla first, plan mode non-negotiable, CLAUDE.md, verification loops. Claims the team ships ~90% Claude-written code.

MODERATE · 2026 · Vibe Coder Blog / Boris Cherny quotes

Profi · Quality & security

Deputy CISO: Claude authors ~80% of merged code; engineers ship 8× vs 2021–2025; more than half merged by Claude Tag. Threats: prompt-injected agents, supply-chain, volume vulns. Controls: shift-left, identity boundaries, deterministic+agentic review, humans at leverage points.

STRONG · 2026 · Jason Clinton / Anthropic

Profi · Quality & security

Operationalizes vibe-coding security as five questions (IDOR, privilege, paid work, secrets in browser, vulnerable deps). Maps seven buckets including prompt injection and unbounded consumption.

MODERATE · 2026 · Bilal Shahid

Profi · Quality & security

Cites ~44% fail security checks (56% pass). Risks: secrets, hallucinated deps, missing validation. Practice: IdP, human reviewer, automated scan on every merge.

MODERATE · 2026 · Evgeniy Altynpara, Yelizaveta Ropalo

Profi · Quality & security

Anecdote plus Tenzai-class numbers: 69 vulns in 15 apps; claims 24.7% of AI-generated code has a vuln. Claude Code used for a backend that still shipped unauthenticated endpoints.

WEAK · 2026 · Sebastian Sleczka

Profi · Quality & security

Prototype vs product split. Repeats Veracode 45% and claims ~86% XSS in tested frontend examples. Names Claude Code, Cursor, and Lovable in a tool breakdown plus a production-readiness checklist.

MODERATE · 2026 · Aleksandr Sheremeta

Profi · Quality & security

48% adopted vibe coding for new projects; 96% do not fully trust functional correctness. AI PRs have 1.4× critical issues. First mistake: bypassing requirements. Spec-driven development is the offered fix.

MODERATE · 2026 · Isaac Sacolick

Profi · Quality & security

December 2025 test of Claude Code, Codex, Cursor, Replit, and Devin: 69 vulnerabilities across 15 apps. Tools dodge generic SQLi/XSS but fail on authorization and business logic. Claude Code had 4 critical-rated findings in that sample.

MODERATE · 2026 · John E. Dunn / Tenzai

Profi · Quality & security

Stacks Veracode 45%, Carnegie Mellon (61% functionally correct / 10.5% pass basic security), 2.74× more vulns than human code, Apiiro 10× more findings/month. Argument: audit between “it works” and production.

MODERATE · 2026 · Babar Khan Akhunzada / SecurityWall

Profi · Quality & security

Defines vibe coding security as fixing risks in prompt-built apps. Cites Veracode 2025: 45% of AI-generated samples had an OWASP Top 10 issue. First risk: authZ skipped unless prompted.

MODERATE · 2026 · Superblocks

Profi · Quality & security

Vendor-primary for the 45% figure previously quoted via Superblocks/SecurityWall: 80 tasks, 100+ LLMs, Java/JS/Python/C#, no security guidance in the prompt. 55% secure / 45% introduce a known OWASP Top 10 flaw; larger/newer models stay flat.

STRONG · 2025 · Veracode Research

Profi · Quality & security

Practical review guide naming Cursor, Claude, Copilot, Lovable, Replit. Recurring issues: secrets, broken auth, unvalidated input, missing rate limits — invisible in a working demo.

MODERATE · 2026 · VibeAudits Team

Profi · Team production

Internal interviews: first-stop for Product Engineering, CLAUDE.md for data-science onboarding, Security Eng using TDD with Claude, lawyers/marketers building tools. Agentic coding dissolving technical/non-technical boundaries.

STRONG · 2025 · Anthropic

Profi · Team production

Second named-metrics story: time-to-market 24 days → 5 (79%), seven-hour autonomous vLLM refactor, 99.9% numerical accuracy claimed, non-engineers contributing via the terminal. Large Japanese tech conglomerate, not a toy app.

MODERATE · 2026 · Anthropic / Rakuten

Profi · Team production

Named-metrics enterprise write-up: Smartsheet (85% of Fortune 500 on the product) deployed Claude Code to 500+ engineers who ship 3x more code and merge 31% more PRs than peers; cycle time −28%; highest performers 5–7x. Still an Anthropic customer page, but it is the Fortune-500-adjacent production numbers this corpus lacked.

MODERATE · 2026 · Anthropic / Smartsheet

Profi · Team production

Official copy-able notebooks: agent SDK, skills, tool use, coding patterns. Includes a repo CLAUDE.md. The recipe book a team should clone before inventing a vibe template.

STRONG · 2025 · Anthropic

Profi · Team production

Author post for the Superpowers methodology (spec, TDD, subagent-driven development) used with Claude Code and other agents. Complements the GitHub repo already filed under loops.

MODERATE · 2025 · Jesse Vincent

Profi · Team production

Second awesome-list (fork lineage) cataloging official resources, agents, skills, plugins, IDE integrations, observability. Discovery surface for a team standing up Claude Code.

WEAK · 2026 · connerkward

Profi · Team production

Community skills marketplace with a production-hardened skill-creator fork of Anthropic’s official skill-creator. Teams install shared workflows instead of pasting runbooks into chat.

MODERATE · 2025 · daymade

Profi · Team production

Julep production notes: CLAUDE.md templates, commit strategy, guardrails. Sacred rule: humans still write tests. Quotes DORA-like 46× deploy / 440× lead-time figures as why practice matters more once AI is in the loop.

MODERATE · 2025 · Diwank

Profi · Team production

Secondary rewrite of Anthropic’s own “how we use Claude Code” story: debug via logs, navigate large codebases, hybrid human+AI loops. Useful as a short onboarding handout, weaker than the primary Anthropic post.

WEAK · 2026 · Vishalini Devarajan

Profi · Team production

Follow-up to the 19% slowdown RCT: August 2025+ pool (10 original + 47 new developers, 800+ tasks) shows some speedup estimates, but METR says selection and measurement bias likely make the figure a lower bound and that the design is breaking as capabilities rise. Not a Fortune 500 write-up — the honest later measurement.

STRONG · 2026 · METR

Profi · Team production

Claude Tag lands 65% of product-engineering PRs for the Claude Code team. Features ship internally first. System prompt shrunk ~80%. Auto mode enables Claude Tag. Advice: be more ambitious to offset Deep Blue despair.

STRONG · 2026 · Simon Willison, Cat Wu, Thariq Shihipar

Profi · Team production

Year-one conversation: Cherny describes armies of agents; Wu steers to verification, routines, auto mode, Loop, fleets, context minimalism. Osmani’s loop-engineering overlay: preserve mistakes, verify, routinize.

MODERATE · 2026 · Grant Harvey / The Neuron

Profi · Team production

LLMOps case: terminal-first, hooks and sub-agents, 1,000 internal dogfooders, weekly iteration, designers/PMs contributing code. Features prototype-to-prod in weeks from feedback, not upfront plans.

MODERATE · 2025 · ZenML / Cat Wu

Profi · Case studies

The public catalog UI for davila7/claude-code-templates: advertised as 1000+ agents, commands, skills, and MCP integrations with a stack builder. Homepage copy is now quoted from the site itself, not only the GitHub one-liner.

MODERATE · 2025 · davila7 / aitmpl

Profi · Case studies

Open toolkit to generate skills, agents, slash commands, hooks at scale. Interactive builder plus `/build skill|agent|prompt|hook`. A factory for the procedures vibe chats otherwise paste.

MODERATE · 2025 · alirezarezvani

Profi · Case studies

Public reading portal: security-first (42 CVEs tracked), TDD/SDD/BDD, 269 templates, 473-question quiz. Homepage now quoted from the site, not the GitHub README tagline.

MODERATE · 2026 · Florian Bruniaux

Profi · Case studies

Argues Plan Mode is the difference between surgical PRs and “did you read the existing code?” reviews. Documents the accidental discovery problem and the no-edits planning prompt.

MODERATE · 2026 · Claude Directory

Profi · Case studies

Tracks Karpathy’s tweet through Collins Word of the Year into production shorthand. Argues today’s “vibe coding” often means managing machine-generated logic destined for prod — which is not Karpathy’s forget-the-code hobby.

MODERATE · 2026 · David Kravets / CodeRabbit

Profi · Case studies

Practitioner guide: spawn subagents with isolated context, tools, worktrees; claims 3×–5× throughput on the right tasks. Cites 600% search growth for “Claude Code subagents” in Q2 2026.

MODERATE · 2026 · Collabnix

Profi · Case studies

Explains context-window as the scarce resource; subagents return summaries; dynamic workflows scale to tens/hundreds of agents. YAML custom subagents. Mirrors official docs with a fan-out how-to.

MODERATE · 2026 · dublecc

Profi · Case studies

Public anonymized data and regression for the early-2025 RCT: speedup of 0.188 means time-with-AI / time-without-AI minus one — developers were slower. A measured case, not a star-count write-up.

STRONG · 2025 · METR

Profi · Case studies

Startup-derived Claude Code workflows since launch day: dual-loop code review (slash commands + GitHub Actions) and OWASP-inspired security review. Tutorials on the author’s YouTube.

MODERATE · 2025 · Patrick Ellis / OneRedOak

Profi · Case studies

Curated skills list with progressive-disclosure explanation (~100 token metadata, then full SKILL.md). Community index on top of Anthropic’s skills repo.

MODERATE · 2025 · travisvn

Profi · Case studies

Community guide: setup, commands, workflows, agents, skills, tips from beginner to power user. A worked curriculum besides Anthropic’s docs.

MODERATE · 2026 · zebbern