Vibe coding is sold as a $10K/month shortcut. Read the survival rate.

Can you make real money vibe coding? A few people can, and their numbers are public. Pieter Levels reports Photo AI at around $100,000 a month, run as one large PHP file on a single server. It was the one that worked after years of projects that didn't. Founders like Marc Lou post similar screenshots. The pitch writes itself: describe an app in plain English, let the model build it, charge for it, quit the day job.

The pitch skips the denominator. For every Photo AI there are tens of thousands of apps that clear nothing, and 2026 was the year the distance between the two widened. RevenueCat, which handles billing for more than 115,000 apps and over $16 billion in revenue, found the top 5% of subscription apps now earn 400 times what the bottom 25% earn, up from 200 times in 2024. Last year the top quarter grew revenue more than 80%. The bottom quarter shrank by a third.

So the honest answer is short. The building got easy. The building was never the hard part.

Vibe coding is a real shift

The term comes from Andrej Karpathy, who posted it on February 2, 2025: "a new kind of coding" where "you fully give in to the vibes, embrace exponentials, and forget that the code even exists." You describe what you want, the model writes it, you run it, you paste the errors back. A year and a half later it is how a lot of software gets made.

The speed is not hype. Levels has shipped working products in days. Non-technical founders now stand up a login and a payments flow over a weekend, for the price of a couple of AI subscriptions (Forbes). That part is true, and it is new. What follows from it is where the pitch and the data split.

The winners are real and unrepresentative

Levels is real. So is his revenue, which he publishes. What the screenshots leave out is the runway underneath them: he had built and killed dozens of products before Photo AI, and he had an audience of hundreds of thousands watching when he launched it. The app was the last 10% of a decade of distribution.

That is the pattern under almost every "$20K in week one" story. The person shipping had a following, a mailing list, or a niche they already understood. The model wrote their code faster. It did not write their audience.

Upwork's own 2026 workforce index makes the same point from the other side: the premium goes to people who pair AI with judgment a client cannot replicate, not to people who can prompt a model. The tool is now everyone's. The edge is what you point it at.

The math the courses leave out

Cheaper building does not mean more buyers. It means more sellers. When anyone can ship a to-do app or a thin wrapper over an API in an afternoon, the market fills with them, and the price of the average one falls toward zero.

The RevenueCat numbers describe that world. A 400x gap between the top 5% and the bottom 25%, widening. The top quarter of apps growing more than 80% a year while the bottom quarter loses a third of its revenue. Distribution decides which side you land on, and vibe coding does nothing for distribution. It arguably makes it harder, by raising the number of apps a buyer has to ignore before they reach yours.

This is the audited version of the promise. Building the product is now the cheap, fast, solved part. Getting anyone to find it, trust it, and pay for it is the expensive, slow, unsolved part, and it is the same problem it was before the models arrived.

You also ship the bugs you never read

There is a second cost the pitch hides. When you forget the code exists, you also forget the security holes in it.

In July 2026, the pentest firm Xint, part of Theori, ran its autonomous scanner across a set of vibe-coded applications and found 434 exploitable issues. The two largest categories were resource-exhaustion and denial-of-service flaws (93), and broken authorization (88), the kind where an app checks that you are logged in but never checks that the record you asked for is yours. A separate, earlier study from the audit firm Kingbird put the share of vibe-coded apps with at least one flaw at 91.5%, though that firm is commercial and did not publish how it picked its sample.

Read the Xint result carefully, because it cuts both ways. The firm found fewer classic injection bugs than it expected and said the underlying models have genuinely improved there. The holes that remain are the ones a model cannot reason about from a prompt: who is allowed to see this record, how many requests this endpoint should accept, where that API key ended up. Those are business rules, not syntax, and they are exactly what "forget the code exists" leaves undefended. A charging app with broken authorization ships a data breach with your name on the invoice.

Who this is for

If you already have an audience and you understand a problem people pay to solve, vibe coding is a real accelerant. Use it, and budget for the two things it does not give you: a plan to get in front of buyers, and a security review before you take a payment. The passive-income framing around AI content has the same shape, and so does the freelance AI premium: the tool is table stakes, the judgment is the job.

If you are buying a course that promises $10K a month because the building is now easy, you are paying for the part that got cheap. The part that is still hard, they cannot sell you.

Sources

• Pieter Levels, Photo AI revenue (levels.io)
• RevenueCat, State of Subscription Apps 2026
• Andrej Karpathy, "vibe coding" post, February 2, 2025
• Forbes, how solo founders are vibe coding for revenue (March 2026)
• Upwork Future Workforce Index 2026
• SecurityWeek, vibe-coded apps riddled with exploitable flaws (Xint/Theori, July 2026)
• SoftwareSeni on the Kingbird 91.5% study (Q1 2026)

This is not financial advice.