This review brings the academic and practitioner evidence on Vibe Coding together under one protocol. Its stated motivation is that knowledge of how the practice is defined, performed and governed is scattered across peer-reviewed studies, preprints, industry reports, blogs, vendor documentation, videos and practitioner discussions, and that existing reviews are limited in scope, evidence coverage or methodological transparency — some are narrative with no documented search, one draws on peer-reviewed sources only, and another documents its process but covers grey literature only. The authors report that no single review had yet integrated both streams under one protocol while jointly synthesizing definitions, workflows, developer-role changes, outcomes, risks, safeguards, tool ecosystems and open challenges.
The method is a multivocal literature review following Garousi et al.’s guidelines, organised with the Goal–Question–Metric paradigm around eight research questions. Query development ran in two stages: a seed and scoping search for the exact phrase in August 2025, which returned 31 sources and surfaced recurring synonyms, followed by a refined systematic search executed across databases and grey-literature channels in October 2025. Broader terms such as “AI pair programming” and “agentic coding” were considered and deliberately excluded from the final query as retrieving a much wider literature. After screening, credibility assessment and snowballing, 47 sources were retained — 28 peer-reviewed and 19 grey — and each extracted code was tagged to exactly one research question so that per-question counts do not double-count.
Two features distinguish the synthesis. Each research question carries a qualitative evidence-strength rating on four levels — strong, moderate, weak and emerging — combining the number of contributing sources, their quality and credibility, and their consistency across the two streams. And denominators are stated per question rather than assumed, because not every source contributed codeable data to every question. The review closes with a conceptual framework in two views and a research agenda.
Key Points
- Across five conceptualization categories drawn from 36 contributing sources, the two most frequent framings are vibe coding as a socio-technical development practice (69%, 25 sources) and as natural-language-to-code or prompt-based development (67%, 24). Agentic or semi-autonomous development appears in 50% (18), the copilot or pair-programming framing in 19% (7), and AI-native development environments in 6% (2).
- Peer-reviewed sources more often anchor definitions in established research terminology such as natural-language programming or agent-mediated development, while grey sources more frequently articulate vibe coding as a practice identity or workflow style emphasizing rapid iteration, experimentation and developer steering.
- Of the 43 sources contributing on workflows, the leading patterns are validation and evaluation pipelines as a core loop (72%, 31) and chat-based iterative development loops (63%, 27), followed by explicit context provisioning (40%, 17), an iterate–prompt–patch loop (35%, 15) and retrieval or documentation grounding (30%, 13). The authors rate this evidence strong and conclude that validation and testing sit inside the loop rather than being optional additions.
- The developer-role finding, from 34 contributing sources, is a shift from writing code directly toward supervising, validating and steering model output and managing the context it is given. Trust calibration and adaptive reliance is the most reported construct (68%, 23), followed by changes in cognitive load (38%, 13), Cognitive Debt from deferred understanding (24%, 8) and flow effects (20%, 7).
- Session-level dynamics — momentum breaks, repeated prompt–patch cycles without convergence, and context-window or state-retention failures — rest on only nine contributing sources, each phenomenon reported by two to four. The authors rate this evidence emerging and say it is better read as an open research direction than an established finding.
- On outcomes, improved productivity and reduced time-to-prototype is the most reported (45%, 21 of 47), ahead of code or UI quality (36%, 17), maintainability implications (23%, 11), defect risks and error patterns (21%, 10) and reproducibility and consistency (6%, 3). The authors read this as a trade-off rather than a general improvement, with quality and maintainability conditional on developer expertise, task complexity and verification practices, and rate the evidence moderate.
- Outcome claims vary by audience and task: productivity dominates novice-oriented sources (12), while expert-oriented sources are more balanced across productivity (7), quality (7) and defects (4); UI and front-end tasks dominate the task-domain evidence while data and machine-learning tasks appear in only two sources.
- The most frequently reported failure mode is hallucinated or incorrect generation (28%, 13 of 47). The remaining modes rest on few sources — licensing and provenance uncertainty (6%, 3), cumulative context errors and iteration drift (4%, 2), and minimal-review commits with insufficient inspection (4%, 2) — and the authors report the last as practitioner-sourced and lacking peer-reviewed corroboration.
- Of the 33 sources on safeguards, validation and testing pipelines are the most recommended (88%, 29), followed by Human-in-the-loop review (48%, 16) and sandboxing or constrained execution environments (15%, 5); explicit guidance on when to avoid vibe coding, and provenance tracking, appear in one source each. The authors note that validation pipelines and human review are frequently proposed but their actual impact in real development settings remains under-tested.
- Usage context is the thinnest question, with 8 contributing sources — prototyping and early-stage development (6), production or operational deployment (2), privacy or data-exposure constraints (2) and cost or usage-limit constraints (1). The authors rate this weak and treat the asymmetry itself as a finding: production deployment and operational constraints are empirically under-studied in the peer-reviewed stream.
- Tool references (39 sources) are led by GitHub Copilot (26), chat-based assistants including OpenAI models (18), Cursor (14, mostly grey), agentic frameworks (10) and Claude (7). The authors organise the ecosystem into four categories — no-code or low-code builders, design-to-code tools, AI-integrated development environments, and autonomous agentic systems — and state that these counts indicate visibility in the literature rather than comparative effectiveness.
- The open challenges, from 20 contributing sources, are led by security risks from AI-generated code (50%, 10), followed by context-management limitations (30%, 6), the absence of standardized evaluation frameworks and long-horizon benchmarks (30%, 6), governance and organizational integration (20%, 4) and trust calibration (20%, 4). The authors conclude that research has moved faster in describing workflows and tools than in evaluating long-term effects.
Notes
The review’s central interpretive contribution is to frame vibe coding as an iterative control system: a feedback-driven process in which the developer repeatedly specifies intent, evaluates generated output and refines the next prompt from observed behaviour. The authors are explicit that they use “control system” conceptually rather than as a formal control-theoretic model, to highlight feedback, monitoring, correction and repeated adjustment. On this reading, generated outputs are provisional proposals requiring inspection, testing or runtime validation before integration — and vibe coding does not remove verification work so much as redistribute it, shifting effort from writing code to reviewing and validating generated output.
The accompanying conceptual framework has two views. The process view captures a single session as an intent–generation–evaluation–refinement loop. The structural view decomposes the phenomenon into four layers — workflow, role and experience, outcomes, and risk and governance — moderated by contextual factors and tool-ecosystem characteristics, with each layer grounded in the corresponding research question.
The authors characterise their own corpus as early and proposal-driven: method proposals, exploratory studies and proof-of-concept work outweigh controlled experiments, surveys and case studies, almost all sources fall in 2025, and 40% is grey literature — which they read as practitioner discussion running ahead of peer-reviewed research. Coverage across the research questions is uneven, and they say the findings are better treated as early indications than settled results. Where the grey evidence for a safeguard category was almost entirely mid-tier, they checked each major category against peer-reviewed evidence and report which ones were corroborated and which remain practitioner-derived.