A year ago, Andrej Karpathy fired off what he later called a "shower thoughts throwaway tweet" about something he dubbed vibe coding. The idea was simple: stop reading the code, stop reviewing the diffs, just describe what you want and let the AI handle it. On February 5, 2026, Karpathy posted a retrospective on X, declaring the concept already passé. He now prefers "agentic engineering."
But vibe coding's most visible artifact isn't going anywhere. Browse Product Hunt, scroll through indie hacker showcases, or just Google any new SaaS tool launched in the past six months. You'll notice something immediately: they all look the same. Purple gradients. Indigo buttons. Glowing card borders. Rounded corners on everything. It is the aesthetic equivalent of a stock photo, and there's a weirdly specific reason it happened.
Blame bg-indigo-500
The culprit, improbably, is a CSS class name. When Adam Wathan built Tailwind CSS and its companion UI library years ago, he made indigo-500 the default button color. Sensible choice at the time: indigo sits between blue and purple, looks professional without being cold, provides good contrast. Thousands of tutorials, blog posts, and open-source projects copied the default. All of that code ended up in the training data for large language models.
The result is a feedback loop that nobody designed. AI models learned that "modern web interface" correlates with indigo buttons and purple gradients because that's what dominated the training corpus. When vibe coders prompt tools like Vercel's v0, Lovable, or Bolt to generate a landing page, the model reaches for the statistically safest option. And so we get more purple pages, which feed back into the next round of training data.
Wathan himself acknowledged it. "I'd like to formally apologize for making every button in Tailwind UI bg-indigo-500 five years ago, leading to every AI generated UI on earth also being indigo," he posted on X last August.
The joke landed differently a few months later. In January 2026, Wathan revealed that Tailwind Labs had laid off three of its four engineers. Revenue had dropped roughly 80% despite the framework being more popular than ever. Traffic to the documentation, the company's only real sales funnel, fell about 40% from early 2023 levels because AI assistants now answer developers' questions directly in their editors. The framework's default color scheme proliferates everywhere via AI-generated code, but the company behind it is fighting for survival.
What "vibe" actually looks like at scale
The sameness problem goes beyond color. AI models trained on similar datasets produce similar structural choices: hero section, three feature cards, testimonials block, gradient call-to-action. One designer on Medium described it as "an intern who goes to Pinterest, finds the best-looking pieces, and uses them all at once." The models don't understand taste or visual hierarchy. They understand frequency.
Vague prompts make it worse. Ask for a "modern, vibrant startup website" and you'll get the purple gradient soup every time. More precise prompts ("minimal layout, one accent gradient on the CTA, flat neutral background") can break the pattern, but that requires design knowledge that many vibe coders don't have. Which is sort of the whole point of vibe coding.
The security angle nobody wants to talk about
Purple pages are embarrassing. The security situation is worse.
In October 2025, the research team at Escape analyzed over 5,600 publicly available vibe-coded applications across platforms like Lovable, Base44, and Create.xyz. They found more than 2,000 vulnerabilities, over 400 exposed secrets, and 175 instances of personally identifiable information sitting in the open, including medical records and bank account numbers. The dataset skewed heavily toward Lovable deployments, but the pattern was consistent.
Earlier that year, Replit engineer Matt Palmer and colleague Kody Low had looked specifically at Lovable-built sites and found 170 out of 1,645 had vulnerabilities exposing personal data. The core issue: Lovable generates slick-looking login forms and authentication flows, but the underlying Supabase database configurations are often misconfigured. Row Level Security policies that look comprehensive contain logic holes. "Authentication theater" is how one security researcher described it to Snyk.
And Veracode's 2025 report found that roughly 45% of AI-generated code contained security flaws across 100 LLMs tested on 80 tasks. No improvement with newer or larger models, which is the part that should worry people.
Even Karpathy stopped vibing
Here's the thing about vibe coding's original pitch. Karpathy was explicit that it was for "throwaway weekend projects." He described hitting Accept All without reading diffs, copy-pasting error messages with no comment, and working around bugs by asking for random changes until they disappeared. It was a joke that became a movement.
By October 2025, Karpathy had shipped a project called Nanochat, a minimal ChatGPT-style interface. "It's basically entirely hand-written," he noted. He'd tried using Claude and Codex agents but found them "net unhelpful." The guy who coined vibe coding hand-coded his own project because the AI wasn't good enough.
His February 2026 retrospective tried to thread the needle. Vibe coding was fine for its moment, he argued, but LLMs have matured enough that professionals should be doing something more rigorous. His proposed replacement term, "agentic engineering," emphasizes oversight and scrutiny rather than vibes. You orchestrate agents who write the code, but you're responsible for reviewing what they produce.
Which sounds a lot like... software engineering with extra steps.
The productivity question
A METR study from July 2025 threw cold water on the whole premise. In a randomized controlled trial, 16 experienced open-source developers completed 246 real tasks. Those allowed to use AI tools (primarily Cursor Pro with Claude 3.5/3.7 Sonnet) took 19% longer than those working without AI. Before starting, the developers had predicted a 24% speedup. After finishing, they still believed they'd been 20% faster.
That perception gap is the real story. Developers felt faster because typing is faster, because autocomplete is satisfying, because watching code appear from a prompt feels like progress. But the downstream cost, reviewing AI output, fixing subtle errors, debugging code you didn't write, ate the gains and then some. At least in this specific context of experienced developers on familiar codebases.
So where does this leave us?
Vibe coding isn't going away, whatever Karpathy wants to call it now. Collins Dictionary named it Word of the Year for 2025. Y Combinator reported that 25% of its Winter 2025 batch had codebases that were 95% or more AI-generated. The tooling is only getting more accessible.
But the web is accumulating a layer of AI-generated sameness that's visible to anyone who pays attention. Purple gradients, identical layouts, security configurations that look right but aren't. Fast Company was writing about the "vibe coding hangover" by September 2025. A January 2026 paper titled "Vibe Coding Kills Open Source" argued the practice reduces engagement with open-source maintainers. And Tailwind's own near-collapse shows how AI can hollow out the very ecosystems it feeds on.
The FTC hasn't weighed in on vibe-coded security failures yet, but consumer data is leaking from applications built by people who don't know what Row Level Security means. That's not a purple gradient problem. That's a real one.
