63 Percent of Vibe Coders Are Non-Developers Now — and the Apps They're Shipping Are Remarkable
On the first Wednesday of February 2026, Liz Baker Plosser — the former editor-in-chief of Women's Health and author of the Best Case Scenario wellness newsletter — sat down at her kitchen table, opened Anthropic's Claude, described the wellness app she wanted, and had a working tool before the rest of her household woke up. She has no formal programming background. She did not hire a developer. The post she wrote about the experience was titled, with deliberate plainness, "I Vibe Coded A Wellness App."
Plosser is no longer an outlier. According to an industry-tracker analysis assembled in February 2026, roughly 63 percent of vibe coding users are non-developers — people building full-stack apps, internal tools, and personal software without ever writing code in the traditional sense. Fifteen months after Andrej Karpathy coined the term "vibe coding," the majority of people doing it are not developers. This week, Tech Times assembled the data and the stories in one place — along with the security incidents that show exactly where the boundary is between what non-developers can safely ship and what still needs a professional. Here is what the 63 percent moment actually means.
Who the 63 Percent Actually Are
The visible cases sort into three rough cohorts, and none of them are who the original vibe coding discourse imagined.
The first is the writer-and-editor cohort Plosser exemplifies. Her post described the build as a creative act adjacent to her editorial practice — the AI handled syntax; she handled product judgment. The result was a working wellness tool, built in a morning, from a kitchen table, by a person whose professional identity has always been about translating fuzzy intent into finished artifacts. She just used a different tool.
The second cohort is professionally adjacent to tech: marketers, investors, and product people who spent years working next to developers and are now building their own ideas. Jim VandeHei, the CEO of Axios, reported in January 2026 building four working apps on his phone in eight hours using Claude — including a 30-question quiz to identify people likely to excel at AI use. "My mind is officially blown in a way it never has been before," he texted his co-founder. The Lynx Collective newsletter author, a former marketer and venture investor with 20 years on the business side, described going "completely Claude Code-pilled" after a friend demonstrated that a non-coder could go from idea to a working application in under an hour.
The third cohort is the most striking. In April 2026, a class of fifth-graders at the Global Idea School in Redmond, Washington — taught by Juan Lavista Ferres, Microsoft's Chief Data Scientist — used GitHub Spark to build a Braille 3D Generator: a working accessibility tool that converts text into printable, tactile 3D Braille models. Lavista Ferres, a 17-year Microsoft veteran, described the moment simply: "We live in an amazing time." The students were not building because they aspired to be developers. They were building because they had a curriculum requirement, a useful idea, and a tool that made the gap between those two things navigable.
That last cohort is important to sit with. Children building accessibility tools for other people, using AI, as part of a normal school day — that is what a technology looks like when it has genuinely crossed the chasm.
What the 63 Percent Are Building
The applications non-developers actually ship tell you something useful about what vibe coding is actually good for in its current form. They are not enterprise competitors. They are: deadline trackers, expense calculators, course quizzes, personal wellness dashboards, fan-fiction generators, novelist-specific reference databases, custom flashcard apps for a single subject, study aids tied to one textbook, and internal tools used by exactly one company.
The Braille 3D Generator is representative in a different way: a specific, bounded problem, a specific known audience, no sensitive user data, no financial transactions, no authentication at scale. The tool works, it was useful to the people it was built for, and it required no security review because the attack surface was zero.
The economics add to the appeal, and occasionally they exceed expectations. Sabrine Matos, a non-technical founder from Brazil, reportedly reached $456,000 in annualized recurring revenue in 45 days building a safety and background-check app using Lovable. That outcome is not representative — but it is no longer unheard of.
Emergent, an Indian vibe coding startup that reached $100 million ARR in eight months after launch, reports that roughly 70 percent of its users have no prior coding experience. About 40 percent are small businesses. The platform was explicitly built for people who want to turn ideas into monetizable software without a development background, and the growth rate says that audience exists at real scale.
The One Thing That Separates Safe Ships from Problem Ships
All of this is genuinely good news. But this week's data reporting would be incomplete without the Moltbook story, because it is the clearest available map of where the boundary is.
In February 2026, a social networking platform called Moltbook launched. The founder built it entirely through vibe coding — he publicly stated he had not written a single line of code. The platform attracted significant attention. Three days after launch, security researchers at Wiz found a misconfigured database that had exposed 1.5 million API authentication tokens and 35,000 user email addresses since day one.
The root cause was not malicious code. It was not a complicated vulnerability. It was a single missing configuration: Supabase's Row Level Security had never been enabled. The AI assistant built a working app. No one asked it to configure database security policies. So it did not.
The Moltbook breach is not an argument against vibe coding. It is a precise description of its current failure mode. The tools generate applications that work. They do not necessarily generate applications that are secured, because security configuration is not visible in the thing you are prompting toward — the UI, the features, the behavior. It lives one level below, in the infrastructure settings that make the app safe to run with real user data.
The practical implication is narrow and specific: if your app uses any database, ask the AI to enable access controls before you go live, and verify that it did. For Supabase, that means Row Level Security. For Firestore, that means security rules. For any external API, it means checking that credentials are stored in environment variables and not written directly into the code. These are not complicated checks. They are the checklist that the Moltbook founder did not have.
Independent audits have found that 40 to 62 percent of AI-generated code contains security vulnerabilities — a range that reflects variation in tools and prompts, but whose lower bound alone makes explicit verification important for any app handling other people's data. Lovable, the Swedish AI app builder that reached roughly $400 million in annualized recurring revenue in 2026, faced three documented security incidents in Q1 alone, including a broken access control vulnerability that was open for 48 days.
Georgia Tech's Vibe Security Radar tracked 35 new CVE entries directly caused by AI-generated code in March 2026, up from six in January. The trend is not slowing down because vibe coding is growing faster than the review habits needed to accompany it.
The good news is that the safe zone for non-technical builders is not small. Personal-use tools, prototypes, educational aids, single-team internal utilities, accessibility tools — these are all appropriate without a professional security review. The line that requires developer involvement is the one where other people's sensitive data enters the picture: health records, financial transactions, authentication at scale, regulated workflows. That line is real. But it does not come close to touching the vast majority of what the 63 percent are actually building.
What Karpathy's "Agentic Engineering" Reframe Means for Non-Developers
In early 2026 — almost exactly one year after he coined the term — Andrej Karpathy announced that "vibe coding" was effectively passé as a description of where the practice was going. His replacement framing: agentic engineering.
The shift is worth understanding because it is often reported as bad news for non-developers, and it is not. Karpathy's distinction is between two postures toward the same tools. Vibe coding, in his original framing, means fully giving in to the vibes — prompting, watching it run, shipping without reading the diff. Agentic engineering means using AI agents with deliberate oversight: you review what the agent produces, you define explicit requirements at the outset, you retain responsibility for architecture and security decisions.
His summary: vibe coding raises the floor. Agentic engineering raises the ceiling.
For non-technical builders, the practical translation is not "stop using these tools" — it is "develop the habit of asking the agent to show its work." Before you go live, ask: "What access controls did you set on the database?" Ask: "Are there any credentials stored in the code files?" Ask: "What happens if someone tries to access another user's data?" The tools will answer these questions. The answers will tell you whether the app is ready to handle other people's data.
This is not a technical skill. It is a review habit. Liz Plosser has a version of it from editing — the practice of reading the output with the intent to find what is missing, not just what is there. The fifth-graders in Redmond were building a tool with no personal data at all, so the security question didn't arise; their version of agentic engineering was simply asking whether the Braille output was accurate. The skill is the same regardless of the domain: look at what was produced and ask whether it actually does what you need it to safely do.
The Tools Making the 63 Percent Possible
The non-developer cohort gravitates toward a specific tier of tool. App builders designed for browser-based, zero-setup creation dominate the entry tier: Lovable for non-technical PMs and founders who want polished finished pages; Bolt.new for speed and full-stack iteration; Replit Agent for apps that need a built-in database and authentication out of the box; v0 for front-end polish within the Vercel ecosystem; GitHub Spark for classroom and solo builder contexts. These tools require no local machine setup, no framework knowledge, and no understanding of deployment infrastructure. The feedback loop is prompt → preview → iterate.
One tier up — for builders willing to learn terminal basics — Claude Code and OpenAI Codex offer more control and are used by both developers and determined non-developers. OpenAI brought Codex to mobile in May 2026, making the full agent available inside the ChatGPT app on iOS and Android across all plans including the free tier.
Karpathy himself noted in late 2025 that AI coding had passed a clear reliability threshold in December 2025. The practical effect is that the tools of 2026 allow someone like Plosser to ship a finished artifact in a single sitting — where the tools of 2024 would have required a developer to clean up after. The floor has risen, and it will keep rising.
The Majority Has Arrived
The numbers that matter most are not the breach statistics. They are the adoption ones.
Vibe coding tools raised approximately $9.4 billion in equity funding between 2022 and 2025. Gartner has forecast that 60 percent of all new software code will be AI-generated by the end of 2026. Collins Dictionary named "vibe coding" its word of the year for 2025. And the market tracking the category puts its projected size at $8.5 billion globally.
But the number that actually captures what happened is the 63 percent. The majority of people building with these tools today are not developers who learned a new workflow. They are people who had ideas for things they needed to exist and now have a path to building them that did not exist two years ago.
The Braille 3D Generator is a working accessibility tool that a class of ten-year-olds built as part of their curriculum. The wellness app is a real product that a real person uses because she described what she wanted and the tools delivered it. The quiz that Jim VandeHei built to test AI aptitude runs on people's phones and generates real data.
For non-technical builders who have been watching this category and wondering whether the moment to start building has arrived: it has been here. The 63 percent got there first. The tools are good enough, the safe zone is large enough, and the checklist that keeps you on the right side of the Moltbook line is short enough to fit in a paragraph.
Build the thing. Ask the agent to show its work. Verify the access controls are on. Ship.
Sources: Tech Times — Vibe Coding for Non-Developers: 63% of Users Now Have No Coding Background, Breaches Follow · SuperFrameworks — Vibe Coding Tipping Point: What Founders Need to Know · TechCrunch — Emergent hits $100M ARR eight months after launch · TechCrunch — OpenAI says Codex is coming to your phone · Hostinger — Vibe Coding Statistics · AI Agents Simplified — From Vibe Coding to Agentic Engineering · Daily.dev — How AI Is Changing Developers Code · Global Idea School — Braille 3D Generator