PaperlayerView exact revision on arXiv

Source-linked AI summary

A Survey of Vibe Coding with Large Language Models

Yuyao Ge, Lingrui Mei, Zenghao Duan, Tianhao Li, Yujia Zheng, Yiwei Wang, Lexin Wang, Jiayu Yao, Tianyu Liu, Yujun Cai, Baolong Bi, Fangda Guo, Jiafeng Guo, Shenghua Liu, Xueqi Cheng

arXiv:2510.12399v2cs.AI

TL;DR

Vibe Coding’s effectiveness and human–AI collaboration remain under-explored, and unstructured instructions can miss nuanced requirements and architectural constraints. This survey formalizes the human–project–agent relationship and synthesizes five development models, highlighting context engineering and deployment challenges as central to practice.

  • Problem

    Task complexity can expose limitations in unstructured natural-language instructions, which may fail to convey nuanced requirements and architectural constraints.

    Source: §1 · p. 4

  • Method

    The survey formalizes Vibe Coding as a constrained decision process over the human–project–agent triad and synthesizes existing workflows into five development models.

    Source: §1 · p. 4

  • Results

    The synthesis identifies context engineering as central to practical deployment, alongside challenges spanning technical infrastructure, security mechanisms, and human factors.

    Source: §10 · p. 42

  • Takeaways & Limitations

    Practical deployment is shaped by context engineering and challenges across infrastructure, security mechanisms, and human factors.

    Source: §10 · p. 42

    Outcome-based informal acceptance testing can support rapid iteration but lacks the rigor of formal quality assurance.

    Source: §9.1.1 · p. 36

Abstract

from arXiv · show

The advancement of large language models (LLMs) has catalyzed a paradigm shift from code generation assistance to autonomous coding agents, enabling a novel development methodology termed "Vibe Coding" where developers validate AI-generated implementations through outcome observation rather than line-by-line code comprehension. Despite its transformative potential, the effectiveness of this emergent paradigm remains under-explored, with empirical evidence revealing unexpected productivity losses and fundamental challenges in human-AI collaboration. To address this gap, this survey provides the first comprehensive and systematic review of Vibe Coding with large language models, establishing both theoretical foundations and practical frameworks for this transformative development approach. Drawing from systematic analysis of over 1000 research papers, we survey the entire vibe coding ecosystem, examining critical infrastructure components including LLMs for coding, LLM-based coding agent, development environment of coding agent, and feedback mechanisms. We first introduce Vibe Coding as a formal discipline by formalizing it through a Constrained Markov Decision Process that captures the dynamic triadic relationship among human developers, software projects, and coding agents. Building upon this theoretical foundation, we then synthesize existing practices into five distinct development models: Unconstrained Automation, Iterative Conversational Collaboration, Planning-Driven, Test-Driven, and Context-Enhanced Models, thus providing the first comprehensive taxonomy in this domain. Critically, our analysis reveals that successful Vibe Coding depends not merely on agent capabilities but on systematic context engineering, well-established development environments, and human-agent collaborative development models.

1 Introduction

The introduction defines Vibe Coding as outcome-oriented collaboration with coding agents and presents the survey’s formal framework and five-model taxonomy. It also highlights that agent capability alone is insufficient: effective collaboration requires structured context and interaction.

1 Introduction

  • 12.5% was SWE-agent’s result with custom interfaces [12]; AutoCodeRover achieved 19.0% resolution [13], Agentless 27.3% [14], and OpenHands 53% on SWE-bench Verified [15].The introduction uses these results to illustrate coding agents’ rapid progress on real-world programming tasks; it also reports 17–53% performance gains for self-improving agents on SWE-bench Verified [16].Source: §1 · p. 4
  • Vibe Coding shifts from manually reviewing generated snippets to validating agent implementations through iterative requirements, execution observation, and feedback [20].Coding agents can configure environments, run programs, diagnose errors, and update implementations, reflecting a move toward outcome-oriented validation [22] [23] [24] [25].Source: §1 · p. 4
  • Experienced developers using Cursor with Claude took 19% longer to complete tasks, underscoring the need for systematic prompt and context engineering, structured instructions, and balanced agency [27] [28] [30] [31] [32] [33].The introduction notes that unstructured natural-language instructions may fail to convey nuanced requirements and architectural constraints [11] [26].Source: §1 · p. 4
  • The survey formalizes Vibe Coding as a triadic relationship among developers, projects, and agents using a Constrained Markov Decision Process, then synthesizes workflows into five development models.The models are Unconstrained Automation, Iterative Conversational Collaboration, Planning-Driven, Test-Driven, and Context-Enhanced.Source: §1 · p. 4

2 Related Work

Related-work surveys cover LLM foundations, prompting, post-training, and agent systems, while preliminary work reviews code-generation training, autonomous coding agents, and tool-use infrastructure.

2.1 Related Surveys

  • Prior surveys map LLM foundations and prompting, in-context learning, context engineering, Chain-of-Thought, and multimodal models [202] [203] [205] [206] [209] [211] [212] [213] [214] [215] [217] [218].They cover architectures, training, capabilities, Transformer efficiency and long-context methods, as well as prompting methods and applications.Source: §2.1 · pp. 5–6
  • Post-training surveys address reinforcement learning, instruction tuning, alignment, reasoning, efficiency, and domain adaptation, including DPO and parameter-efficient methods [220] [223] [224] [225] [227] [228].Coverage includes RLHF and RLAIF, training-free and personalized alignment, and LoRA and adapters.Source: §2.1 · p. 6
  • Agent surveys cover construction, planning, memory, tool use, evaluation, multi-agent collaboration, and coding agents across the software development lifecycle [230] [231] [232] [233] [234] [235] [237] [240] [242] [243] [244].Coding-agent surveys specifically address planning, context management, tool integration, and benchmarking frameworks.Source: §2.1 · p. 6

2.2 Preliminary

  • Code-generation reinforcement learning studies use executable feedback, including unit tests and compiler feedback, in approaches ranging from early RL to group-relative optimization [246] [247] [248].Methods include PPO refinement, multi-granularity test feedback, curriculum subtasks, and ranking-based alignment.Source: §2.2 · p. 6
  • Autonomous coding-agent work spans single-agent and multi-agent systems, repository-level generation, role-based collaboration, test-driven development, and self-repair [10] [12] [13] [14] [99] [104] [110] [251].Reported approaches include hierarchical localization, iterative retrieval-generation, assembly-line roles, and chat-chain architectures; self-repair gains are described as modest and limited by self-feedback.Source: §2.2 · pp. 6–7
  • Function-calling research develops tool-use training, execution environments, API benchmarks, retrieval, deployment optimization, and multi-agent coordination [26] [150] [255] [257] [258] [259] [260] [262].Examples include safe multi-language execution, executable code as an action space, latency and cost optimization, and instruction-API datasets supporting cross-language transfer.Source: §2.2 · p. 7
  • Supervised code-model training includes instruction evolution, self-instruction, transparent self-alignment, specialized tuning, and repository-level pretraining [5] [6] [44] [264] [265] [266] [267] [268].Specialized work targets security, optimization, editing, debugging, and refinement; foundation models use diverse languages, extended contexts, and large-scale sampling and filtering.Source: §2.2 · p. 7

3 Vibe Coding: The Engineering of Managing Coding Agents

Vibe Coding is a human–project–agent collaboration in which human feedback guides implementation and can evolve requirements. The section presents it as a way to extend individual developers’ capabilities, support iterative quality work, and broaden who can create software.

3.1 Definition of Vibe Coding

  • Vibe Coding is an engineering methodology [20] modeled as a Constrained MDP in which humans set goals and evaluate outputs, projects constrain states and transitions, and agents execute policies.Humans shift from direct code authors to intent articulators, context curators, and quality arbiters; projects include codebases, databases, and domain knowledge.Source: §3.1 · pp. 7–8
  • Human feedback drives a closed loop in which requirements expand monotonically, while humans govern what and why, projects constrain where, and agents determine how.Progressive clarification lets people refine constraints after observing agent outputs and add requirements when implicit needs or boundary cases emerge.Source: §3.1 · p. 10

3.2 Why Vibe Coding

  • Coding agents give individual developers team-scale capabilities across frontend, backend, databases, security, DevOps, and QA [10] [150], while developers focus on requirements.The section says this can reduce learning overhead and compress prototypes from weeks to days, including for resource-constrained entities.Source: §3.2 · p. 10
  • Vibe Coding seeks to improve development velocity and code quality through autonomous iteration, automated testing, refactoring, and profiling, with humans validating architectural decisions.Automating mechanical work frees cognitive resources for design and optimization, while rapid iteration enables broader exploration.Source: §3.2 · p. 11
  • Vibe Coding broadens software creation by making natural language a primary interface [4] [5], enabling domain experts to build and monetize tools without computer science education or technical co-founders.The section connects this lower technical barrier to more diverse innovation and an expanded creator economy.Source: §3.2 · p. 11

4 Large Language Models for Coding

The section surveys how coding LLMs are built and adapted, from corpus curation and pre-training objectives to continual training, supervised fine-tuning, and reinforcement learning. It highlights data quality, training strategy, and specialization as recurring themes.

4.1.1 Pre-training Code Corpora

  • Code pre-training corpora balance depth in popular languages against breadth across many languages, using quality filtering and provenance controls [279] [36] [37].The Stack offers 3.1 TB across 30 languages, whereas Stack v2 spans 67.5 TB across 619 languages [36] [37]. RefineCode and SwallowCode apply extensive filtering, validation, deduplication, and rewriting [39].Source: §4.1.1 · p. 11

4.1.2 Instruction & Preference Datasets

  • Instruction and preference datasets draw on licensed code and synthetic data, with scalable methods that bootstrap examples, increase task complexity, or seed tasks from open-source code [279] [44].OpenCodeInstruct contains 5 million samples and SynCode-Instruct nearly 20 billion tokens; CodeUltraFeedback and PLUM use ranked responses or GPT-4-generated unit tests for preference data [42] [43].Source: §4.1.2 · p. 12

4.2.1 Pre-training Objectives

  • Code-model objectives range from masked and autoregressive prediction to denoising, structure-aware, contrastive, and multimodal training [288] [53] [47] [48].MLM is prominent for code understanding, while autoregressive models support generation and fill-in-the-middle completion; encoder-decoder models use span denoising. GraphCodeBERT models data-flow structure, and CodeT5+ combines span denoising with contrastive learning [53] [52] [292] [293] [55] [56] [47] [48].Source: §4.2.1 · pp. 12–13

4.2.2 Continual Pre-training Strategies

  • Over 20% average performance improvement over code-only training followed Qwen2.5-Coder’s 7:2:1 code, text, and mathematics mix during continual pre-training.Continual pre-training extends broad pre-training with domain data; DeepSeek-Coder-V2 continued from intermediate checkpoints using 6 trillion additional tokens. Forgetting motivates replay, while selected data may improve end-task performance; stability gaps and small-token corpora remain challenges [327].Source: §4.2.2 · pp. 13–14

4.3.1 Supervised Fine-tuning

  • High-quality demonstrations can outperform preference fine-tuning on challenging coding tasks, and AlpaGasus reported gains from 9,000 filtered examples.Supervised fine-tuning adapts pre-trained models with labeled examples, while adapter tuning and LoRA reduce trainable parameters; CodeGen and StarCoder also fine-tune on selected monolingual data [58] [332].Source: §4.3.1 · p. 15

4.3.2 Reinforcement Learning

  • RL post-training refines models beyond pre-training, and RL-trained OpenAI o-series models and DeepSeek-R1 outperform comparable models without RL on demanding reasoning and coding benchmarks [71] [340].RLHF aligns behavior with reward signals from human preference judgments [71] [2].Source: §4.3.2 · p. 15

Core Components Core Capabilities · Memory Mechanism

The section outlines the coding-agent architecture and surveys reinforcement-learning methods for code generation, including their applications and unresolved post-training challenges.

Core Components Core Capabilities

  • The architecture combines a Cognitive System, Memory Mechanism, and Tool Integration with planning, action execution, and multi-agent collaboration.These components support coordinated software development tasks.Source: Figure 5 · p. 16

Memory Mechanism

  • DPO replaces complex RL rollouts with classification-style preference-ranking losses, while GRPO adds group-wise comparative feedback to address DPO limitations [71] [341].Source: Memory Mechanism · p. 16
  • RLVR replaces learned reward models with deterministic, task-specific rules, proving particularly effective where correctness is objectively verifiable, such as coding and mathematics [343].Source: Memory Mechanism · p. 16
  • CodeRL uses critic-predicted functional correctness as reward, while PPOCoder learns from compiler and test outcomes, and StepCoder uses curricula of increasingly complex subtasks.These approaches build on reinforcement learning for code generation across programming domains [336] [341].Source: Memory Mechanism · p. 16
  • VeriSeek demonstrates reinforcement learning for generating correct hardware-description-language code in challenging Verilog tasks.Source: Memory Mechanism · p. 16
  • RL post-training risks catastrophic forgetting and reward hacking, and benefits are reported mainly for models with 8 billion to 670 billion parameters [345].Applying RL to models with one billion or fewer parameters remains difficult because of training instability and sample-efficiency bottlenecks.Source: Memory Mechanism · p. 16
  • RL training also faces sample-inefficient exploration and a mismatch between maximizing cumulative reward and Pass@k evaluation, which favors finding at least one correct solution [340] [346].Source: Memory Mechanism · p. 16

5 LLM-based Coding Agent

LLM-based coding agents combine decomposition and planning, memory, tool use, iterative refinement, and multi-agent collaboration to tackle complex software tasks. The section describes these capabilities, their methods and architectures, and reported performance gains.

5.1.1 Task Decomposition Strategies

  • CoT is the most popular code-generation strategy and achieves higher correctness, while adaptive and multi-path plans can still hallucinate incoherent plans.The section describes prompting-based CoT, Auto-CoT, Plan-and-Solve, ToT, and HyperTree Planning as decomposition techniques.Source: §5.1.1 · p. 17

5.1.2 Plan Formulation Methods

  • Planning methods include LLM-as-Planner, LLM-as-Facilitator translating plans into PDDL, and multi-agent planning, with feedback and memory supporting adaptation but long-horizon coherence remaining difficult.Approaches include external planner or memory modules, finetuning on trajectories, and search; challenges also include actionable goal decomposition and scarce training data.Source: §5.1.2 · p. 17

5.2.1 Overview and Fundamentals

  • Memory extends agents beyond static context windows: short-term memory maps to limited-capacity inference context, while long-term memory can be parametric in model weights or non-parametric in external systems.The section relates context and parameters to short- and long-term memory, respectively.Source: §5.2.1 · p. 17

5.2.2 Memory Operations and Management

  • Memory operations support persistent codebase, pattern, and debugging knowledge through reading, writing, and reflection, alongside procedures for consolidation, indexing, updating, forgetting, retrieval, and compression.Selective memory management is reported to yield 10% gains.Source: §5.2.2 · pp. 17–18

5.2.3 Memory Architecture in Coding Agents

  • FALCON uses hierarchical short-term memory for immediate feedback, while MemTool achieves 90-94% efficiency; long-term architectures include FIFO long-context, RAG, and agentic memory systems.Other designs use temporal forgetting, dual-component memory, cached reasoning, or virtual context paging.Source: §5.2.3 · pp. 18–19

5.3.1 Tool Invocation

  • Tool invocation has evolved from fixed JSON calls toward executable-code frameworks, standardized interfaces, and dynamic tool discovery; specialized-tool agents have outperformed commercial products including GitHub Copilot.The section also describes tool integration that reduces hallucinations and API-specification pipelines that generate executable functions.Source: §5.3.1 · p. 19

5.3.2 Code-based Action Implementation

  • Code-based actions enable agents to revise prior actions from observations, support repository-scale tasks, and coordinate specialized agents; reinforcement learning and code generation also extend to knowledge analysis.The section describes systems for autonomous evolution across large codebases and KnowCoder variants for extraction, multilingual transfer, and analysis.Source: §5.3.2 · pp. 19–21

5.5.2 Framework Implementations

  • MapCoder’s four-agent collaboration achieved 93.9% on HumanEval, 83.1% on MBPP, 22.0% on APPS, 28.5% on CodeContests, and 45.3% on xCodeEval.The section also describes MetaGPT and ChatDev as practical role-based collaboration frameworks.Source: §5.5.2 · p. 22

6 Development Environment of Coding Agent

Coding-agent environments combine isolated, reproducible execution with interfaces and protocols that integrate agents into developer workflows. Their reliability and scale also depend on validation pipelines, cloud orchestration, and coordinated human–agent or multi-agent collaboration.

6.1.1 Containerization Technologies

  • Containerization provides portable, reproducible execution with lightweight isolation, rapid startup, and resource efficiency compared with virtual machines, supporting repeated and secure execution of generated code.Kubernetes assigns agent tasks to isolated pods, applies computational quotas, and enforces timeouts to prevent resource monopolization [136].Source: §6.1.1 · pp. 22–23

6.1.2 Security Isolation Mechanisms

  • Sandbox isolation and hybrid policy enforcement constrain potentially unsafe agent code, limit file, network, and environment access, and provide logging for auditability [11] [137] [138] [452] [459].gVisor enforces fine-grained safety policies, while multi-layer frameworks combine container isolation with dynamic monitoring [137].Source: §6.1.2 · p. 23

6.1.3 Cloud-based Execution Platforms; 6.3.2 Cloud Compute Orchestration

  • Cloud execution platforms scale isolated workloads across clusters, while orchestration manages resources and deployment across cloud environments [463] [136] [467].Deployments use separate execution and judging pods; TOSCA enables platform-agnostic cloud application modeling and migration [463] [467].Source: §6.1.3 · pp. 23–24, §6.3.2 · p. 25

6.2.1 AI-Native Development Interfaces

  • Unified inline suggestions and conversational interaction improve task efficiency and user satisfaction, while contextual memory and persistent dialogue support more coherent assistance.Inline completion supports rapid iteration; conversation supports explainability and collaboration.Source: §6.2.1 · p. 24

6.2.2 Remote Development

  • Remote, containerized workspaces provide reproducible environments synchronized with version control, while remote compute lets developers use resource-intensive workflows through lightweight clients.SSH connections and browser terminals support transitions between local and cloud execution contexts.Source: §6.2.2 · p. 24

6.2.3 Tool Integration Protocol Standards

  • MCP, LSP, and DAP standardize context exchange, language services, and debugging, allowing agents to participate in existing IDE and version-control ecosystems [96] [477] [479] [146] [143].Their integration supports seamless requests, modifications, and analysis of project context [479] [146] [143].Source: §6.2.3 · p. 24

6.3.1 CI/CD Pipeline Integration

  • CI/CD pipelines validate and test agent-generated code before integration, while human oversight remains indispensable at critical verification stages.Agent participation can include code generation, static analysis, and self-testing, but safe and transparent integration remains a deployment challenge.Source: §6.3.1 · pp. 24–25

6.3.3 Multi-Agent Collaboration Frameworks

  • Multi-agent frameworks use specialized roles, structured communication, and feedback loops to improve scalability, reliability, and interpretability, but face coordination overhead, consistency, and conflict-resolution challenges [150] [154] [486].They redistribute tasks after agent failures and use role specialization and iterative verification; overly frequent exchanges can add overhead, while weak synchronization risks semantic drift [486].Source: §6.3.3 · p. 25

7 Feedback Mechanisms

Coding-agent feedback turns code generation into iterative refinement through compiler, analysis, execution, clarification, review, and self- or multi-agent feedback. Its effectiveness depends on useful feedback and is limited by unreliable tests, misunderstood requirements, and weaknesses in self-correction.

7.1.2 Static Analysis Feedback

  • LLMs achieved 69-81% accuracy in prioritizing static-analysis warnings and 81.13% precision with 94.64% recall when inspecting thousands of warnings [504].Static analysis checks code without execution but can produce many warnings, including false positives [500].Source: §7.1.2 · p. 26

7.1.3 Runtime Compilation Feedback

  • Compilation success rose from 44.18% to 89.18% with CompCoder’s three-stage pipeline [279] [246].Coding agents use compilation and runtime signals—including failed tests, execution traces, intermediate variable values, and verbal suggestions—for iterative refinement [243].Source: §7.1.3 · p. 27

7.2.1 Unit Test Execution Results

  • Unit-test feedback supports verification, reinforcement learning, debugging, filtering, and optimization, but unreliable generated tests, computational cost, and limited coverage can mislead refinement or let bugs pass [172] [173].CodeT achieved 65.8% pass@1 on HumanEval using test outcomes for code-sample filtering [176].Source: §7.2.1 · pp. 27–28

7.2.2 Integration Test Feedback

  • Structured test feedback achieved the highest repair success rates, and additional repair rounds improved performance with diminishing returns after two or three iterations.Test-executor agents coordinate code generation and validation; code selection also uses test outcomes, dual-execution agreement, and verifier-based reranking [176] [534].Source: §7.2.2 · p. 29

7.2.3 Runtime Error and Exception Handling

  • Runtime-error research identifies five primary types—syntax, parameter and attribute, output type, logical answer, and timeout/runtime errors—and Healer handled 88.1% of AttributeErrors [516] [182].Approaches range from pass/fail signals and test traces to debugging agents and iterative self-correction [428] [429] [167] [111] [177].Source: §7.2.3 · p. 29

7.3.1 Interactive Requirement Clarification

  • 45.97% average absolute improvement in pass@1 code generation accuracy was achieved within 5 user interactions when systems clarified underspecified requirements [243].Yet state-of-the-art models often generate code for ambiguous instructions without seeking clarification, and they struggle to distinguish underspecified from well-specified requests [243].Source: §7.3.1 · pp. 29–30

7.4.1 Self-Evaluation and Critique

  • GPT-4 gained 8.7 points in code optimization and 13.9 points in code readability using Self-Refine prompting.Self-correction works well primarily when reliable external feedback is available, and large-scale fine-tuning appears necessary for effective self-correction [193].Source: §7.4.1 · p. 31

7.4.3 Reflection and Memory-Based Feedback

  • 91% pass@1 accuracy on HumanEval was reported for Reflexion, versus previous GPT-4 performance of 80%, an 11 percentage point improvement through verbal reinforcement.Self-Refine achieved approximately 20% absolute improvement in task performance across diverse applications while requiring minimal computational resources [548].Source: §7.4.3 · p. 32

8 Vibe Coding Development Models

The section classifies Vibe Coding into four workflows plus a cross-cutting context enhancement, using human oversight, structured constraints, and context management; the models can be combined.

8.1 Framework Principles

  • The framework classifies models by human quality control, structured constraints, and context management, distinguishing workflows by collaboration boundaries and allowing strategies to compose.Humans provide requirements in UAM, review in ICCM, design in PDM, and define standards in TDM, where machines verify.Source: §8.1 · p. 33

8.2 Unconstrained Automation Model (UAM)

  • UAM accepts AI output with little code scrutiny, favoring rapid prototypes but risking vulnerabilities, technical debt, and difficult maintenance; it is unsuitable for production or safety-critical systems.The model is recommended only for low-risk uses such as disposable prototypes, proof-of-concepts, and personal utilities.Source: §8.2 · p. 33

8.3 Iterative Conversational Collaboration Model (ICCM)

  • ICCM iterates AI generation, human review and understanding, and testing, supporting maintainable team code while requiring developer expertise and adding review and testing costs.It is suited to professional development, medium-to-large projects requiring long-term maintenance, and team collaboration.Source: §8.3 · pp. 33–34

8.4 Planning-Driven Model (PDM)

  • PDM has humans specify architecture and plans before AI implementation, reducing directional drift and supporting modular, coherent complex applications at the cost of upfront planning.Vertical-slice architecture gives AI clear end-to-end feature boundaries and can reduce later maintenance and refactoring needs.Source: §8.4 · p. 34

8.5 Test-Driven Model (TDM)

  • TDM has humans define tests and acceptance criteria while AI implements against them through red-green-refactor, using tests as objective constraints.With comprehensive tests, automated verification reduces line-by-line auditing and supports quality gates, making TDM suitable for critical logic and systems requiring long-term maintenance.Source: §8.5 · p. 34

8.6 Context-Enhanced Model (CEM)

  • CEM adds retrieved project code, documentation, and rules to prompts so AI-generated changes fit existing codebases; it is a cross-cutting enhancement, not a standalone workflow.It can be combined with any of the four models and is especially effective for large-codebase maintenance, cross-file changes, refactoring, and global operations.Source: §8.6 · p. 35

9 Future Impact and Open Challenges · 9.1 Reengineering of Development Process in Vibe Coding

Vibe Coding adds accelerated AI-mediated cycles to traditional development processes and shifts developers toward orchestration, context management, and behavioral evaluation. These process changes remain under-explored, with limited longitudinal validation and no documented large-scale enterprise case studies in the supplied passages.

9.1 Reengineering of Development Process in Vibe Coding

  • Vibe Coding supplements traditional development with AI-mediated cycles and new demands on process design, developer responsibilities, project management, and quality assurance, but its impacts lack longitudinal validation.The discussion projects an evolutionary trajectory from synthesized characteristics of the paradigm [20].Source: §9.1 · p. 35

9.1.1 From Phased Lifecycles to Continuous Micro-Iterations

  • The “prompt-generate-validate” cycle compresses work from Agile-sprint weeks to seconds or minutes, enabling iterative goal-satisfaction exchanges that blur SDLC phases [561] [562].A high-level user story can become prompts for a functional prototype, whose interaction refines requirements and lets design emerge through dialogue [561].Source: §9.1.1 · pp. 35–36

9.1.2 Redefinition of Developer Roles and Skillsets

  • As agents handle syntactic construction, developers increasingly direct systems and engineer prompts; evaluation expands to prompt engineering, context curation, and system-level reasoning, augmenting rather than replacing programming skills [243].Articulating complex requirements as effective prompts requires creative and analytical understanding of how a model responds, not its internal architecture [20].Source: §9.1.1 · p. 36, §9.1.2 · p. 36

9.1.1 From Phased Lifecycles to Continuous Micro-Iterations

  • Continuous informal acceptance testing supports rapid iteration but lacks formal Quality Assurance rigor; structured Test-Driven methods provide a concrete, verifiable target for the AI agent [567].In this model, the developer first defines formal tests, which the AI agent must then generate code to pass.Source: §9.1.1 · p. 36

9.1.2 Redefinition of Developer Roles and Skillsets

  • Debugging shifts from line-by-line inspection of opaque generated logic to behavioral diagnosis through hypotheses, targeted tests, and prompts that regenerate or patch faulty components [568, 569].Source: §9.1.2 · p. 36
  • Practitioners curate APIs, schemas, code snippets, and design patterns to constrain generation, while overseeing architecture and project integrity; dynamic context-management platforms remain immature or absent.Architectural oversight becomes harder when underlying code is not a direct product of the developer’s own mind.Source: §9.1.2 · p. 36

9.1.3 New Challenges in Project Management and Collaboration

  • Effort estimates become unpredictable, and code reviews of AI-generated code expand beyond line-level correctness to prompt history, generated tests, and behavior against requirements [574] [575].Source: §9.1.3 · p. 36
  • Team collaboration may shift from pair programming to “mob prompting,” but absent documented large-scale enterprise case studies, these changes remain under-explored and need empirical research [581] [582].Source: §9.1.3 · p. 37

9.2 Code Reliability and Security in Vibe Coding

Vibe Coding trades speed for certainty: outcome-based validation can miss reliability and security flaws, including vulnerabilities reproduced from public code. Production use therefore requires automated, continuous safeguards embedded in the development workflow.

9.2.1 The Inadequacy of Manual Review

  • Manual expert review conflicts with Vibe Coding’s speed and may fail when developers lack expertise in unfamiliar libraries or complex algorithms [587].The section argues for shifting from human-centric inspection to automated, real-time validation.Source: §9.2.1 · p. 37

9.2.2 Architecting an Integrated Security and Reliability Feedback Loop

  • A robust feedback loop couples coding agents with SAST, DAST, and quality tools in the interactive prompt-generate-validate cycle, beyond conventional CI/CD scans.Before generation, agents can detect security-sensitive prompt terms and inject secure-coding guidance or templates.Source: §9.2.2 · p. 37
  • Real-time SAST can scan streamed, incomplete code, while a closed loop could send detected vulnerabilities back to the LLM for correction before display.Amazon CodeWhisperer’s integrated scan is an early example [591].Source: §9.2.2 · p. 37
  • Sandboxed execution can run just-in-time DAST, monitor runtime faults and insecure communications, and fuzz new endpoints or data-processing functions.Static and dynamic analysis complement each other to cover a wider range of potential issues.Source: §9.2.2 · p. 37
  • An advanced system could maintain a dynamic threat model to identify attack surfaces or security-policy violations as features change.The analysis would assess each prompted change in the context of the whole application.Source: §9.2.2 · p. 38

9.2.3 The Human-in-the-Loop as a Final Arbiter

  • Developers remain the final risk-based decision-makers, interpreting tool outputs and resolving ambiguity, but integrated real-time security frameworks lack standardized specifications [20].Building these frameworks remains a research and tooling challenge; without them, Vibe Coding risks staying limited to prototyping and non-critical applications.Source: §9.2.3 · p. 38

9.3 Scalable Oversight of Vibe Coding Agents

As coding agents become more autonomous, oversight must expand from checking generated code to governing agents across repositories, pipelines, and environments. The section identifies systemic risks and proposes layered, adaptive oversight that grows with agent capabilities.

9.3 Scalable Oversight of Vibe Coding Agents

  • Traditional peer review and post-deployment audits cannot feasibly monitor the millions of tokens or decisions agents may generate per hour.The resulting gap between agent capability and human supervision is a critical obstacle to safe, accountable Vibe Coding workflows.Source: §9.3 · p. 38

9.3.1 Emerging Risks of Vide Coding Workflow

  • Production use of autonomous agents correlates with a tenfold increase in security warnings and technical debt within six months, exposing the limits of human-centric verification.Opaque decision pathways also make interpretability and control harder to maintain.Source: §9.3.1 · p. 38
  • Cascading errors turn flawed agent outputs into downstream failures, as perturbations destabilize multi-agent workflows and toolchains [598] [122] [599] [600].Shared model assumptions and data dependencies can correlate errors, while inadequate containment and traceability make traditional debugging and peer review insufficient in fully autonomous settings.Source: §9.3.1 · p. 38
  • Nearly one-fifth of packages suggested by code-generation models are nonexistent or untrusted, while automated import suggestions can propagate vulnerable or deprecated modules [602].Fuzz-testing agents may inject unverified binaries and build-automation agents may bypass provenance enforcement, expanding attack surfaces and undermining SBOM and supply-chain transparency [603].Source: §9.3.1 · pp. 38–39
  • Coding agents can optimize explicit task metrics while disregarding implicit safety or maintainability constraints, and reward overfitting can yield functionally correct but normatively undesirable behavior [606].This divergence obscures accountability and motivates interpretable reward modeling, continuous supervision, and human intervention to keep execution aligned with developer intent [605].Source: §9.3.1 · p. 39

9.3.2 Toward Scalable Oversight Architectures

  • Weak-to-strong oversight uses layered reviewers and checks to extend limited feedback into constraints on more capable agents, but oversight success declines when an agent exceeds its overseer by several hundred Elo points [615].Hierarchical supervision decomposes complex judgments into simpler subtasks; GPT-4 fine-tuned with noisy GPT-2-level guidance achieved results comparable to GPT-3.5 on complex reasoning tasks [618].Source: §9.3.2 · pp. 39–40
  • Multi-agent debate and critique can combine code generation, adversarial testing, and self-correction, while model-aware scanners, formal verification, and watchdogs provide layered safeguards [617] [509].The broader aim is adaptive oversight—through critique and automated monitoring—that evolves with agent capability and keeps even superhuman coding systems answerable to human-aligned constraints [613] [618] [615].Source: §9.3.1 · p. 39, §9.3.2 · p. 40

9.4 Human Factors in Vibe Coding

Vibe Coding shifts developers from directly manipulating code logic toward context engineering and human-AI collaboration, reshaping their skills, team responsibilities, and organizational practices [28, 623, 624].

9.4.1 Mental Model Shift: From Code Logic to Context Engineering

  • In Vibe Coding, developers increasingly curate prompts, context, and constraints to guide AI output; prompting substitutes for manual implementation, making verification the central locus of human activity [31] [28] [630].They design high-level problem frames, construct testing scaffolds, and iteratively refine AI outputs, bringing software engineering closer to product design and requirements engineering [633].Source: §9.4.1 · p. 40

9.4.2 Evolving Developer Skill Sets

  • Developers need prompting and context-design, task-decomposition, verification, and agent-governance skills as they shift from code producers to supervisors of AI-driven workflows [31, 627, 28, 628, 634, 629, 530, 584, 635, 585, 636, 637, 632, 624, 638, 639, 640].These include modular prompts, retrieval-augmented prompting and prompt libraries; decomposing complex tasks; testing, static analysis and formal verification; and managing access, execution privileges, and provenance under least-privilege principles [634] [530] [637].Source: §9.4.2 · pp. 40–41

9.4.3 Team Collaboration and AI Integration

  • Coding agents can act as quasi-team members, but over-reliance, automation bias, and unclear responsibility for vulnerable AI-generated code make calibrated trust and accountability frameworks essential [642] [633] [35] [641] [644].Human-code review processes may not suit the scale and pace of AI-generated code; proposed responses include automated verification pipelines, provenance watermarks, and formal verification [641].Source: §9.4.3 · p. 41

9.4.4 Broader Implications

  • Computing curricula should teach prompting, AI governance, and human-AI collaboration, while organizations may elevate design, requirements, and test creation as low-level implementation becomes increasingly automated [645] [28] [633] [243].Without curricular reform, future developers may lack effective oversight skills.Source: §9.4.4 · p. 41

10 Conclusion

The survey establishes Vibe Coding as a principled discipline, formalizing the human-project-agent relationship and synthesizing development models, technical foundations, and practical implications. It emphasizes that reliable agentic coding depends on context engineering, executable feedback, and human oversight—not model quality alone.

10 Conclusion

  • The paper formalizes Vibe Coding as a constrained decision process linking human intent and quality control, project context, and coding-agent policies.The formulation specifies the triad’s roles, interfaces, and optimization targets for agentic software development.Source: §10 · pp. 41–42
  • The survey consolidates practice into five composable models—Unconstrained Automation, Iterative Conversational Collaboration, Planning-Driven, Test-Driven, and Context-Enhanced—for distinct risk, speed, and governance needs.It also situates the triadic formulation within human-cyber-physical systems and human-in-the-loop computing.Source: §10 · p. 42
  • The survey synthesizes code-model training, agent planning, memory and tool use, execution infrastructure, and compiler, runtime, human, and self-refinement feedback.It argues that context management and executable feedback loops, rather than model quality alone, determine performance and maintainability in long-horizon tasks.Source: §10 · p. 42
  • A taxonomy organizes development choices along human quality control, structured constraints, and context management, linking these axes to composable workflows for project-specific requirements and system coherence.The axes provide a shared vocabulary for comparing methods and engineering trade-offs.Source: §10 · p. 42
  • The paper identifies a shift toward context engineering and verification, with emerging skills in prompting, task decomposition, quality supervision, and agent governance.These changes reshape team collaboration, accountability, and trust, motivating training, process-design, and governance recommendations grounded in human oversight.Source: §10 · p. 42
  • The survey identifies context engineering and challenges in technical infrastructure, security, and human factors as central to practical Vibe Coding deployment.Its contributions span a formal definition, five-model taxonomy, and synthesis of the LLM, agent, development-infrastructure, and feedback ecosystem.Source: §10 · p. 42

Related papers

Loading 2510.12399v2…