# Why Specs Are Replacing Vibes

The counter-argument to pure vibe coding got its sharpest form this week: specs first, code second. The numbers behind the shift are stark — Veracode’s 2025 data put OWASP Top 10 flaws in about 45% of AI-generated code, and a METR study found developers with AI tools took 19% longer, not less. The tooling answer is spec-driven: AWS Kiro (July 2025) writes requirements, design, and tasks first; GitHub’s Spec Kit (September 2025) formalizes specify/plan/tasks/implement.

## Key facts

- Karpathy coined 'vibe coding' in February 2025; it was named Collins's word of the year at the end of 2025 (per Imran Khan's November 1, 2026 Medium essay).
- Veracode's 2025 report found roughly 45% of AI-generated code contained OWASP Top 10 vulnerabilities, with an 86% failure rate on XSS.
- METR research found developers using AI tools took 19% longer on tasks while self-estimating they were 20% faster.
- AWS Kiro (July 2025, successor to Amazon Q Developer) starts a feature from requirements.md, design.md, and tasks.md.
- GitHub Spec Kit (September 2025) formalizes the stages as specify, plan, tasks, and implement.
- The essay's argument: the industry is moving from prompting by feel to developing from written specs.

Part of the vibe coding: from prompts to parts — and why specs are taking over collection at https://aiservicesmarket.lol/vibe-coding/