Vibe coding left the laptop this month. The review step needs to come with it.

For most of its short life, "vibe coding" meant something you did on your own machine for your own amusement: describe what you want, accept what comes back, keep going. In the first half of October, three announcements pushed it somewhere else: onto phones, into company tools, and into agents that run commands on your behalf. The safety net hasn't moved as fast.

I build a VS Code coding agent, so I spend a lot of time thinking about the moment between "the model wrote it" and "it's real". Here's what changed and what I think it means.

1. Vibe-coded apps can now live in Google Play

On 13 October, Google Play started letting people build Android apps in Google AI Studio and run them privately on their own devices through a personal library, without a paid developer account. The apps aren't publicly listed or searchable, and Google says sharing with friends and family, and eventually public publishing after Trust & Safety review, will come later (TechCrunch).

That's a genuinely nice thing for personal tools. It also means a prompt-built app now has a direct path to the device in your pocket, the one with your contacts, photos and banking apps on it. "Private" limits who can install it, not what the code does once it's there.

2. Inside companies, nobody can see most of it

A survey of 307 CIOs, CTOs and CISOs, published by VentureBeat as a piece sponsored by Retool (so read it with that in mind), found:

• only 5% are very confident they have full visibility into the internal tools running across their organization
• 60% of builders say they've built something outside IT's oversight in the past year
• just 4% of leaders say they have governance that covers AI-generated code (VentureBeat)

The vendor angle is obvious, but the scenario they describe is one most of us have seen: someone exports customer data to a CSV, builds a dashboard on a personal account, and publishes it to a public URL.

3. Agents got sandboxes, but you have to turn them on

On 7 October, GitHub made local sandboxing for Copilot generally available in Copilot CLI, the Copilot app and VS Code sessions using Agent Host. It limits which files agent-run commands can read or modify, controls network and credential access, and lets enterprises require it (GitHub changelog).

This is real progress. The docs are also refreshingly blunt about the default: local sandboxing is off, and until you enable it, shell commands Copilot runs "can read, write, and delete wherever you can, reach any network your machine can reach, and use your credentials without restriction" (GitHub Docs). That's true of most coding agents today, not just Copilot.

Models are being trained to stop and ask

Google's Gemini 4 Argon announcement (13 Oct) says the model was trained to "respect system boundaries, report negative findings honestly, and pause for human confirmation before taking irreversible steps." Google reports shortcut attempts dropped to 2% on coding benchmarks where models have no incentive to hold back (Google). That's the lab's own number, but the direction matters: labs are treating "know when to stop" as a capability.

The best-documented example of the human side is Cockroach Labs' five-month coding-agent pipeline: more than a million lines landed with 7 reverts, with human approval kept in the loop (Cockroach Labs). Even there, one urgent one-line fix took 11 rework rounds over two days. The team responded with a circuit breaker that hands off after four consecutive new-finding rounds or six rounds of any kind (Reveneau's summary). Agents need a rule for when to stop, and so does the process around them.

What I think "reviewing a vibe-coded change" should look like now

None of this means you should stop vibe coding. It means the cheap, fast part needs a cheap, fast check attached:

1. Turn the sandbox on if your agent has one. If it doesn't, at least run it in a project folder without secrets in reach.
2. Make every agent step undoable. A checkpoint per turn, so a bad step costs you a revert, not an afternoon.
3. Read the diff, not the chat. The model's summary of what it did is a claim. The diff is what happened.
4. Keep secrets and customer data out of prompts. Neither a sandbox nor a private listing fixes data you've already sent.
5. Decide in advance where "just accept it" is fine. A personal to-do app and an auth middleware deserve different levels of trust.

In CodeCook, my VS Code agent, every turn is checkpointed with native diffs, keep all / revert all and rewind, for exactly points 2 and 3. Whatever you use, the point is the same: in October, vibe coding got a lot more reach. The review step has to keep up.

Sources checked 21 October 2026.