Vibe Coding Success Stories Show Where AI-Built Software Works

The case for vibe coding now rests on named companies

Vibe coding has moved past its early reputation as a viral trick for building toy games over a weekend. In late August, Forbes contributor Bernard Marr published five corporate examples of the practice, which means describing software in plain English and letting AI write the code. The examples were Booking.com, Zapier, Adidas, the UK practice Northern Health, and the toolmaker Leatherman.1 Marr's conclusion was that companies willing to invest in experimentation and culture are seeing real gains in efficiency.1

The examples are worth reading closely. Taken together with the year's revenue figures and a growing pile of security research, they show where vibe coding pays off and where it keeps failing. Most of the successes fall into two groups: trained professional developers working faster, and non-developers building internal tools for small audiences. The failures cluster in public-facing apps that handle other people's data and money.

What the five stories actually show

Booking.com rolled out AI coding assistants to its roughly 3,500 engineers in early 2025. Uptake was slow at first and picked up only after developers were trained to use the tools well.1 Marr reports that developer output, measured as finished and reviewed work, rose 30 percent, and that job satisfaction went up too.1 An earlier account from IT Revolution describes the result more narrowly: developers committed up to 30 percent more merge requests, with smaller diffs and shorter review times, using Sourcegraph and its agents.8 The two accounts agree on the size of the gain. The IT Revolution version is more useful because it names the metric, which is merge-request volume rather than some broader measure of productivity.

Adidas went through the same arc of early rejection followed by adoption. In the company's first pilot, about 90 percent of participating developers said they disliked the tools and called them a waste of time.1 A second pilot went much better: developers said they felt 20 to 25 percent more effective, and the time they spent actually coding, rather than on administrative work, rose by half.1 IT Revolution's write-up of the 700-developer program adds a harder number. Seventy percent of developers saw productivity gains of 20 to 30 percent, measured by commits, pull requests and feature-delivery speed.8

The other three stories describe something different: people outside engineering building software themselves. Zapier growth marketing manager Matt Brown used Claude to build an internal dashboard for tracking influencer partnerships. The AI generated the data structure and front-end code and fixed bugs along the way, and the tool is now used in the team's weekly briefings.1 At Leatherman, staff in manufacturing, marketing, finance, HR and operations have put more than 250 apps, dashboards and automations into production.1 The most striking example is Northern Health. A doctor there used Replit to build 16 features of a remote-care platform in four days, at a reported cost of £165. The features included appointment booking, prescription requests, subscription payments and Fitbit integration.1

The common thread is a small audience or a trained developer

Marr's framing is that encouraging experimentation unlocks value.1 That is true, but it leaves out an important point. In the two clearest enterprise wins, Booking.com and Adidas, professional engineers used AI inside existing review processes, and the results improved only after training.18 The Zapier and Leatherman examples are mostly internal tools, where a bug costs some time rather than exposing customer data.1

An independent audit of ten vibe-coded projects by a fractional CTO lines up with this pattern. The five that shipped cleanly were a marketing site, an internal sales dashboard, a nonprofit registration form, a personal finance tracker, and a startup MVP that helped raise a $500,000 seed round.5 The auditor says the MVP worked because its founder could code, reviewed every generated function, and wrote the authentication and API-key handling by hand.5 The five projects that needed rescuing cost between $3,500 and $15,000 each to fix. They included a Stripe secret key exposed in front-end JavaScript, a booking system that double-booked clients, an app where any logged-in user could read other customers' data across 47 endpoints, and a marketplace that lost track of about 15 percent of more than $200,000 in payments.5

This is why the Northern Health story is the hardest of the five to judge. It is a striking demonstration of speed and cost. But a patient-facing platform with payments and health-device data is exactly the kind of software security researchers say vibe coding handles worst. The published account does not say how the platform was reviewed before patients used it.1

The money says the shift is real

The business numbers leave little room to call vibe coding a fad. Lovable co-founder Fabian Hedin said in late September that the platform had passed $600 million in annual run-rate revenue, up from about $500 million in June.16 In August the company raised $400 million at a $13.3 billion valuation and reported more than 60 million projects created since its November 2024 launch.13 Replit raised $400 million at a $9 billion valuation in March and says it is on track for $1 billion in annual recurring revenue by the end of 2026. That figure is a company target, not a result.13 Cursor reportedly passed $4 billion in annualized revenue in early June.13

Estimates of the overall market are much less reliable. A widely repeated figure puts vibe coding platforms at about $4.7 billion in 2026, growing 38 percent a year.1118 Even analysts who cite that number warn that firms define the market differently and that the figures should be treated as rough.18 One tracker says plainly that no verified total exists.13 Revenue figures for individual companies also vary depending on when each report was written: Lovable has been listed at anywhere from $300 million to $500 million in different 2026 roundups.1418 The direction is clear even though the exact size is not.

The same data points to a gap between use and confidence. One compilation of Stack Overflow survey results puts the share of developers using or planning to use AI coding tools at 84 percent, while trust in those tools has fallen to 29 percent.18

The security record pushes the other way

The research on vibe-coded software is much more consistent than the success stories, and it is not encouraging. A September study on arXiv audited 200 publicly deployed apps built with Claude Code and Lovable and found 1,186 vulnerabilities. Ninety-one percent of the apps had at least one flaw, and nearly two-thirds of the flaws were rated critical or high.22 The most common problems were broken access control, injection and authentication failures.22 The researchers also describe a deployed healthcare platform that leaked large amounts of customer data because of broken access control.22

Other research points the same way. Veracode found that AI models introduced OWASP Top 10 vulnerabilities in 45 percent of coding tasks, and the Cloud Security Alliance notes that this rate did not improve across testing rounds into 2026.26 CodeRabbit's comparison of pull requests found 2.74 times more security issues in AI-co-authored code than in human-written code.25 A Carnegie Mellon benchmark found that 61 percent of AI-generated solutions worked correctly but only 10.5 percent were also secure.30 Georgia Tech's Vibe Security Radar recorded CVEs attributed to AI-generated code rising from 6 in January 2026 to 35 in March.25

The details of these studies sometimes differ. Escape.tech's scan of production apps is described as covering 1,400 apps in one account and 5,600 in others.2528 But no major study comes to the opposite conclusion. Several also suggest that prompting alone will not fix the problem: adding vulnerability hints to prompts did not close Carnegie Mellon's security gap.30

The verdict

Vibe coding works, and the evidence suggests that the conditions matter more than the tool. When trained engineers keep their review processes, the gains are real and measurable but modest, around 20 to 30 percent.8 When non-developers build tools for themselves or their own teams, the speed and cost advantages are dramatic and the risk is limited.15 The trouble starts when a demo built for a small audience goes into production for strangers, with logins, payments or medical records attached. Those are the areas where the security studies keep finding the same failures.2224

For companies, the lesson from these five stories goes beyond encouraging experimentation. Companies should let AI handle the routine work, keep people responsible for authentication, authorization and payments, and test running applications before customers use them. Vibe coding has lowered the cost of building software, but it has not lowered the cost of a breach.