Why Specs Are Replacing Vibes
The counter-argument to pure vibe coding got its sharpest form this week: specs first, code second. The numbers behind the shift are stark — Veracode’s 2025 data put OWASP Top 10 flaws in about 45% of AI-generated code, and a METR study found developers with AI tools took 19% longer, not less. The tooling answer is spec-driven: AWS Kiro (July 2025) writes requirements, design, and tasks first; GitHub’s Spec Kit (September 2025) formalizes specify/plan/tasks/implement.
Key facts
- Karpathy coined 'vibe coding' in February 2025; it was named Collins's word of the year at the end of 2025 (per Imran Khan's November 1, 2026 Medium essay).
- Veracode's 2025 report found roughly 45% of AI-generated code contained OWASP Top 10 vulnerabilities, with an 86% failure rate on XSS.
- METR research found developers using AI tools took 19% longer on tasks while self-estimating they were 20% faster.
- AWS Kiro (July 2025, successor to Amazon Q Developer) starts a feature from requirements.md, design.md, and tasks.md.
- GitHub Spec Kit (September 2025) formalizes the stages as specify, plan, tasks, and implement.
- The essay's argument: the industry is moving from prompting by feel to developing from written specs.
Sources
Skills this case demonstrates
Workflows
Spec-Driven Agent Workflow
Write the spec first, then let the agent write the code.
Security
AI Code Security Review
Review AI-generated code against the OWASP Top 10 before it ships.
More cases
Ten Minutes, One Steel Part
Vibe coding has a hardware sibling: ‘vibe manufacturing,’ where a chatbot designs a part and the file goes straight to a manufacturer or a h…
Read case →
Half a Day vs Five Months
The most dramatic data point for AI-assisted rigor: Stanford researcher Chuyue Sun used AI to formally verify part of Signal’s encryption co…
Read case →Original summary by AI Services Market. Facts sourced from public reporting.