Teach the Loop, Not the Tool
Vibe-coding courses at universities (Stanford, CMU, UChicago, Utah, Michigan) and in industry (DeepLearning.AI, Google/Kaggle, Maven, Campus × Replit) now share one design. Students vibe-code and deploy a prototype in week one, then move from browser chat to an IDE assistant to an autonomous agent, adding specs, git, tests, review and security as they go, and they are graded on process evidence and on explaining their code, not on whether it runs. The research supports that design. AI help reliably raises task completion, but without guardrails it erodes debugging and code comprehension, and weaker students come away believing they understand more than they do. At CMU, 15-113's own survey data show understanding falling to its lowest point of the year once agents took over. Vibe-coded apps also fail in predictable ways: public database keys with no row-level security (the database rules that limit who can read or write each row), leaked secrets, invented package names and destructive agent commands. The September 2026 free-tool landscape can support an eight-week course, but it is thinner and changes faster than a year ago. GitHub Copilot Free or Student inside VS Code is the most dependable no-cost agent path, with agent mode, MCP (a standard for connecting agents to tools) and a command-line agent (CLI) at $0. Google AI Studio is the most generous free app builder. Claude Code and the Codex CLI effectively cost $20 a month. Gemini CLI's free login, GitHub Spark, Firebase Studio and GitHub Models have all disappeared since June. Age now restricts the stack as much as price does, because Claude, AI Studio, Antigravity and Jules are 18+ only. A free-tier Vibe Coding 101 should therefore teach one tool-agnostic safe loop (spec, plan, one small task, run and test, read the diff, commit). It should give every tool two tested fallbacks, save all work to GitHub, concentrate explanation checks in the agent weeks, build its security unit around the Lovable and Moltbook breaches, and re-check every tool the week before each cohort.
Existing courses start with vibe coding, then hand students more autonomous tools
AI-assisted programming became an established course genre in 2025–26. A UCSD-led syllabus study screened US credit-bearing upper-division courses in March 2026 and found 23 that require generative AI in graded software-engineering work, from Kalamazoo (Fall 2023) to Michigan (Fall 2026) (Geng et al., arXiv 2608.05898). At least three have "Vibe Coding" in the title: Utah CS 3960, Northeastern CS 7180 and St. Thomas SEIS 606. The name does not mean the course is for beginners. Utah expects experienced programmers, and Northeastern's course is at master's level (Utah syllabus; NEU CS 7180).
The truly introductory offerings are UCSD's CS1-LLM, a first programming course rebuilt around Copilot in Fall 2023, and CMU's 15-113 "Effective Coding with AI". For Fall 2026, 15-113 split into two 7-week mini-courses, and students who have taken only the intro course can take the first half at 6 hours a week (CS1-LLM paper; CMU 15-113). Outside universities, Class Central lists more than 80 vibe-coding courses (Class Central). Google and Kaggle's free five-day vibe-coding intensive in June 2026 drew 353,000+ registrants and 6,000+ capstone submissions (Google recap).
Two orderings recur, and most courses blend them. The first is a ladder of increasingly autonomous tools: browser chat, then an IDE assistant, then a terminal agent, then extensions such as rules files, skills, hooks and MCP, then parallel or background agents. CMU 15-113 deliberately put its first project on browser chatbots so students would feel that workflow's limits before meeting VS Code and Copilot in week 2. It saved spec-driven agent work, where students write a SPEC.md and hand it to one or more agents, for late homework (CMU 15-113 Student Wisdom report). Northeastern's CS 7180 climbs the same ladder explicitly, from Claude Web and Artifacts to an AI IDE to Claude Code (NEU CS 7180).
The second ordering is a walk through the stages of building software. CMU 17-316 opens with unstructured vibe coding on new and existing code. It then adds discipline stage by stage: user discovery, user stories, dev specs, frontend, backend, testing and CI, deployment, monitoring and a postmortem (CMU 17-316). UChicago's nine-week Design, Build, Ship holds parallel agents and agent loops back until weeks 6–8, after UI/UX and full-stack basics (UChicago MPCS 51238).
Utah takes a third approach. It orders its course by engineering concern (context, testing, modularity, workflows) around one project that grows every week, because keeping AI from breaking older features is its central theme (Utah syllabus). Almost every course puts specs early and review, security and deployment late. No controlled study has compared these orderings; the evidence is design rationale and student surveys (Geng et al., arXiv 2608.05898).
A newer move in 2026 is to show students how an agent works, early and at no cost. Stanford CS146S opens Fall 2026 by building a Claude Code clone in about 200 lines. Students then route a real agent session through mitmproxy, a tool that records network traffic, and annotate its system prompt and tool calls, tagging every claim as observed or inferred (CS146S site; Fall 2026 Week 1 spec). Utah had students change a calculator using only an agent's tools (view, find-and-replace edit, bash, undo) while barred from opening the editor (Utah calculator repo). Michigan's EECS 498 has students write their own agent against a raw API on a deliberately small local model, on the argument that a weak model makes sloppy engineering visible (UMich AASE syllabus).
Stanford's course also shows how quickly designs tied to vendors go out of date. In Fall 2025 each week featured one partner tool and a guest from that company: Ollama, MCP, Cursor, Claude Code, Warp, Semgrep, Graphite and bolt.new. The final project was 80% of the grade (Fall 2025 archive). The week-2 setup told students to redeem a free year of Cursor Pro, a program Cursor closed to new sign-ups on 25 June 2026, and the bolt.new promo required a credit card (W2 spec; Cursor help; W8 spec).
Fall 2026 was rewritten around concepts that do not depend on a vendor: context engineering, skills, AGENTS.md, hooks, agent-ready repos and background agents. It also moved 30% of the grade to open-source contributions (CS146S site). The public assignment repo has about 5,000 GitHub stars, so its assignment types are widely copied (GitHub repo): prompt-technique drills, building an MCP server, a scan-and-fix security lab, comparing a student's own pull-request review with an AI reviewer's, and building the same app in three technology stacks.
The closest models for an eight-week, hands-on 101 share a two-project arc: a quick deployed win early, then a deployed capstone.
| Course | Length and load | Audience | Tools and student cost | Projects | Assessment signature |
|---|---|---|---|---|---|
| CMU 15-113 mini 1 (Fall 2026) | 7 weeks, 6 h/week | After intro CS | All free: Gemini/Antigravity and Kiro through university login, plus free tiers of Claude, ChatGPT/Codex and Copilot | Portfolio site on GitHub Pages; deployed web app with prompt log and demo video | Mock-job-interview orals plus quizzes 20%, TA meetings 10%, effort-graded homework 20% |
| UChicago Design, Build, Ship (Spring 2026) | 9 weeks, 2 h class + ~1 h async | Master's; programming, git and Unix required | Claude Code; students must buy about $240 of Claude Max because the free university enterprise plan runs short from week 2 | Design, Build and Ship phases ending in a week-9 Project Fair with peer voting | Project-centric |
| Campus × Replit VibeCoding 101 (from Jan 2026) | 8 weeks, one live class a week | Non-technical professionals | Replit; $1,500 tuition | Four apps, a landing-page portfolio, a documented flagship project | Not published |
| UMich EECS 498 AASE (Fall 2026) | 15 weeks, 4 credits | Upper-level | $0: Aider on a small local Ollama model, with lab machines as fallback | Pair-programmer build; own agent with evals; persistent assistant | No exams; in-person lab checkoffs and hackathons; required AI log |
| Utah CS 3960 "Vibe Coding" (Spring 2026) | 15 weeks, ~5 h/week outside class | Experienced programmers | Amp with vendor-sponsored credits and a free-mode fallback | Text editor grown weekly; physics simulator; final project | 60% assignments, 30% effort-graded in-class work; missing AI logs fail the assignment |
| DLAI "Build with Andrew" (Jan 2026) | About 1 hour | No coding or AI background | Any chatbot; free to audit | Birthday-message generator, table-tennis game, own project | Quiz |
Sources: CMU 15-113; UChicago MPCS 51238; Campus program page; UMich AASE syllabus; Utah syllabus; DLAI Build with Andrew.
Industry courses come in three formats. Short video courses. DeepLearning.AI's run 1–2 hours, in lessons of 1–26 minutes built around one or two worked projects, and end in a graded quiz (DLAI Vibe Coding 101 with Replit). Google's "Vibe Coding for Beginners" runs about 7 hours, from a Firebase website edited with Gemini, to Gemini CLI, to a PDF invoice generator. Coursera offers no free audit of it (Coursera). Vendor academies. These are free but tied to one tool. Anthropic's Claude Code 101 requires a Pro, Max or Enterprise plan or an API key (Anthropic Academy). Microsoft's GitHub Copilot CLI for Beginners runs on Copilot Free in Codespaces (Microsoft for Developers). Live cohorts. Maven's Elite AI Assisted Coding asks 3–5 hours a week, splits homework into core and stretch tiers, and revises its curriculum every quarter (Maven). Campus × Replit is the only program found with the same eight-week shape as the planned course (Replit blog).
Across all three formats the project arc is nearly identical. Beginners start with a single-file browser app, such as a greeting card, joke generator, small game or landing page. They repeat the same loop on a second app, usually a game, because games give instant visual feedback and need no backend. They then add persistence, auth or an API, deploy, and finish with a capstone. Vanderbilt's no-code series offers a different model, with projects built on learners' own files: dashboards, expense analyzers and folder organizers (Coursera: Build Anything with AI).
Learner reviews reward building and punish lecturing. Jules White's Claude Code course averages 4.7/5 across 178 reviews, yet its critics call it superficial and lecture-heavy, with no hands-on assignments. Another learner hit errors following the exercises exactly as written and objected to the subscription and credit costs (Coursera reviews). Reviews of CU Boulder's "Vibe Coding Fundamentals" range from complaints that it is too basic to praise from people who can now build apps. A search-result summary of the reviews also reports non-programmers struggling with jargon the course never explains (Coursera reviews). "Beginner" labels are unreliable too: DeepLearning.AI's Replit course carries the label but recommends some coding experience (DLAI).
Courses now grade whether students can explain the code, not whether it runs
When AI writes most of the code, courses stop grading the code and start grading the student's understanding and process. In the syllabus study, all 14 conventionally graded courses counted participation, at a median weight of 17.5%. Projects had a median weight of 50%, and only three courses had any proctored assessment. The authors conclude that these courses assess AI-assisted engineering through ongoing practice rather than exams (Geng et al., arXiv 2608.05898).
The ACM Task Force on generative AI and programming assessment surveyed about 500 educators in 2026, and 68% had already changed their assessment. The most common changes were more in-person exams, less weight on take-home work, oral defenses, and grading process over product. The report notes a clear move away from trying to make assignments AI-proof (ACM Task Force report).
Five assessment methods recur. Process logs. Utah fails any assignment without logged AI work (Utah syllabus). Michigan requires an AI log with sessions, model disclosure and an index of evidence (UMich). CMU 15-113 capstones need a README and a prompt log (CMU 15-113), and Stanford's week-2 lab gives half its points to the recorded prompts (W2 spec). Oral checks. CMU 15-113 follows each project with a TA interview styled as a mock job interview and graded on process, transparency and ownership (CMU 15-113). UCSD's CSE 190 can hold back a grade until the student walks staff through the code (UCSD). CS1-LLM required a five-minute video with at least three minutes explaining one function, and grading took 10–15 minutes per project (CS1-LLM). AI-free writing. CMU 17-316 bans AI from reflection essays, which must describe concrete moments when the tool did something the student did not expect; students then defend their views in class (CMU 17-316 HW1). UCSD bans AI from peer reviews and design documents and penalizes heavily for reviews containing errors that are made up (UCSD). Grading robustness and specs over demos. Utah warns that AI makes brittle prototypes easy, so it gives credit only for edge cases, how features interact, and taste (Utah syllabus). Michigan's build rubric is half spec and design, half implementation and tests (UMich). Stanford grades a comparison of the student's own pull-request review with an AI reviewer's (W7 spec). Code handoff. In CMU 15-113's HW7, students swap unfinished games and must fix, finish or extend what they receive (Student Wisdom report). Michigan's syllabus sums up the shift: "If you can't explain it, you didn't build it." (UMich AASE syllabus)
Introductory courses also set skills students must show without AI. CS1-LLM's final exam had three parts: 70% on tracing, explaining, testing and debugging without AI, 15% on writing code without Copilot, and 15% on one large problem with Copilot. Exam results largely matched those of pre-AI cohorts (CS1-LLM; Vadaparty et al. 2025). Students were unsure where the line was, though: 31.1% were not confident which problems they should be able to solve without Copilot, and the instructors said they should have spelled that out (CS1-LLM).
CS50 takes the opposite approach. It bans outside AI tools and allows only its own tutor, the CS50 Duck, which guides students toward answers instead of giving them and limits use through a "hearts" system to control cost (CS50 academic honesty; Liu et al., SIGCSE 2024).
Most course policies now follow the same line: AI is required or encouraged for code, banned for writing addressed to other people, and students must be able to explain everything they submit. CMU 15-113 cares more about transparency than about how much students relied on AI (CMU 15-113). Courses give students tool access in five ways: free tools (Michigan's local Ollama models; CMU's university-provided Gemini and Kiro plus vendor free tiers), vendor sponsorship (Utah's donated Amp credits), institutional accounts (Stanford's Claude Code through student logins in Fall 2026, though UChicago's free enterprise plan was not enough), student-paid subscriptions (about $240 of Claude Max at UChicago, Claude Pro at $20 a month recommended at Northeastern, and a suggested $20 a month for several months at Maryland), and course-built tutors such as CS50's Duck.
Sources: UMich; CMU 15-113; Utah; F26 W1 spec; UChicago; NEU; UMD CMSC 398Z.
The all-free model has friction. In CMU 15-113, free-tier credits on Copilot, Claude, Gemini and Render each ran out mid-assignment for at least one student. Students also reported that deployment took more time than coding (Student Wisdom report).
AI boosts output but weakens the skills beginners most need
The field moved from "vibe coding" to "agentic engineering" in fourteen months
Andrej Karpathy coined "vibe coding" on 2 February 2025. He meant a deliberately careless style: accept every diff, stop reading the code, paste errors back without comment. He said it was fine for throwaway projects (post reproduced in Geng et al., arXiv 2507.22614). Within six weeks Simon Willison had separated it from responsible AI-assisted programming, with a golden rule: never commit code you could not explain to someone else (Willison, Mar 2025). Collins named "vibe coding" its 2025 Word of the Year (CNN).
By April 2026 Karpathy was describing two tiers. Vibe coding lets anyone build prototypes. "Agentic engineering" is the professional discipline for building serious software with agents. He added that responsibility for security, and understanding of the code, cannot be handed to the agent (Karpathy, Sequoia Ascent 2026).
Professionals mostly do not vibe. 72.2% of Stack Overflow's 2025 respondents said vibe coding is not part of their work (Stack Overflow 2025). Field observation of experienced developers found that they plan first and check all agent output (Huang et al., arXiv 2512.14012). Students will meet conflicting usage: Kim and Yegge's 2025 book uses "vibe coding" for disciplined production work (IT Revolution). A course called Vibe Coding 101 should teach the original meaning and explain why the field moved past it.
AI raises output but lowers understanding unless teachers add structure
The main risk for learners is misjudging their own understanding, not getting syntax wrong. Three studies show it. Prather et al. (ICER 2024) watched 21 students solve a problem with Copilot and ChatGPT. The ten who struggled developed new problems: constant suggestions broke their concentration, the tool led them down wrong paths, and they fell behind without noticing. They finished believing they had done better than they had. Stronger students used AI to speed up code they had already planned (Prather et al., "The Widening Gap"). Kazemitabaar et al. found that generating a whole solution from one prompt gave the best first-try correctness but the worst results on later modification tasks. Learners reached for AI before writing any code in 92% of 760 tasks (Koli Calling 2023). Anthropic's January 2026 randomized trial had 52 mostly junior engineers learn a new async library. The AI group scored 50% versus 67% on the follow-up quiz (Cohen's d = 0.74), was not significantly faster, and fell furthest behind on debugging questions (Anthropic). The AI users who scored well asked for explanations with the code, asked only conceptual questions, or fixed errors themselves. Low scorers handed over everything or used AI to debug instead of to understand.
Studies of novices vibe coding show the same pattern. Geng et al. had 19 students think aloud while building with Replit Agent. Only 7.4% of their actions involved looking at code or logs. 91.7% of their tests tried common cases and 2.2% tried edge cases. No student wrote a unit test, and 61% of prompts asked the AI to debug (Geng et al., arXiv 2507.22614). Fawzy et al. surveyed 162 vibe coders and found that non-developers, novices and professionals were equally aware that AI code has weaknesses. Yet 46.3% of non-developers never code without AI, and none always check the code. Accumulated coding practice, not awareness, predicted who checked (arXiv 2605.24521). The ACM Task Force adds that less-skilled students use AI more but benefit less (ACM).
Structure changes the outcome. The best randomized trial of guardrails comes from high-school math, not coding. Bastani et al. (PNAS 2025, about 1,000 students) found that unrestricted ChatGPT-style help raised practice performance 48% but cut unaided exam scores 17%, and the affected students did not notice. A tutor that only gave hints, loaded with teacher solutions and common mistakes, raised practice performance 127% with no significant exam harm (PNAS). Coding versions of that design exist: CodeAid ran for 12 weeks with 700 students (CHI 2024), and CS50's Duck is designed to guide rather than give answers (Liu et al.).
Two other results set expectations. A randomized trial with 979 intro-programming students found that teaching them to use AI as a tutor improved their prompting. Those early gains predicted final-exam scores, but the groups did not differ directly on the exam (Xiao et al., arXiv 2602.16033). A 210-student study found that AI use students directed themselves, with no instruction, produced no measurable learning gain (Lepp, arXiv 2607.24755).
Two exercise formats are well received but have little outcome data. In "Prompt Problems," students write a prompt and the code an LLM generates from it is automatically tested. "Explain in Plain English" grading scores a student's explanation of code by testing the code an LLM generates from that explanation (Denny et al.; Smith & Zilles).
The most relevant course data come from CMU 15-113's Spring 2026 surveys. Satisfaction, understanding and code-reading scores rose through the first five assignments and peaked on the databases assignment (understanding 4.8/7), where students read and partly wrote the code. All three then fell together across the three agent assignments. The spec-to-agents homework scored 3.2/7 for code reading, and the phone-app assignment's understanding score of 3.03/7 was the year's lowest. Students also rated writing the spec as harder than managing the agents (Student Wisdom report). Treat this as a signal, not proof: the scores are self-reported, and the instructor notes that an LLM drafted most of the report before he revised it by hand.
Three questions remain open. No semester-long randomized trial has tested teaching non-programmers through vibe coding. No experiment has compared course orderings. And no study has tested whether writing specs or tests first helps novices learn.
Feeling faster is not the same as being faster
The best measured productivity evidence contradicts how people feel. METR's July 2025 randomized trial followed 16 experienced open-source developers through 246 real tasks. With early-2025 AI they were 19% slower, yet they believed they were about 20% faster (METR 2025). METR's February 2026 follow-up estimated an 18% speedup for returning developers and 4% for new ones. METR itself calls those numbers unreliable, partly because many developers refused to work without AI (METR 2026 update). Its May 2026 survey found median self-reported speedups of about 3×, and warned that people have historically overestimated how much time AI saves (METR survey).
Google Cloud's DORA 2025 report surveyed about 5,000 people, and 90% use AI at work. AI adoption correlates with shipping faster but with less stable releases. The report calls AI an amplifier of an organization's existing strengths and weaknesses (Google Cloud). Two of the seven capabilities DORA says make AI helpful are strong version control and working in small batches (DORA AI Capabilities Model). Trust is falling even as use grows. Only 32.7% of Stack Overflow's 2025 respondents trust AI accuracy, and 66% said their top frustration is code that is almost right but still wrong (Stack Overflow 2025).
Practitioners agree on one safe loop
Vendor guides and prominent practitioners describe nearly the same workflow. Anthropic's Claude Code best practices say to give the agent a way to check its own work (tests, build exit codes, screenshots) and ask it for evidence rather than claims of success; work in the order explore, plan, implement, commit; keep the project rules file short; use hooks for anything that must always happen; and, after two failed corrections, clear the context and write a better prompt. They also warn that the agent's own checkpoints do not replace git (Claude Code docs).
Other guides agree. OpenAI's Codex guide structures every non-trivial prompt as goal, context, constraints and done-when, and keeps lasting guidance in AGENTS.md (Codex best practices). GitHub's Spec Kit requires each stage to finish before the next starts: specify, plan, tasks, implement (GitHub blog). AWS Kiro writes acceptance criteria in EARS form (WHEN a condition holds, THE SYSTEM SHALL do something), a format non-programmers can learn in minutes (Kiro). Addy Osmani recommends small chunks, frequent commits as save points, rules files, and tests as feedback (Osmani 2026). His "70% problem" describes non-engineers who get most of the way fast, then stall on edge cases and production readiness because each bug fix breaks something else (Osmani). Simon Willison recommends red/green test-driven development with agents: write a failing test, then make it pass (Agentic Engineering Patterns).
AGENTS.md is an open format for a README written for agents. It is used by 60,000+ open-source projects and read by nearly every major agent (agents.md). The shared loop is to describe the goal in a spec, let the agent propose a plan, edit that plan, run one small task, run the tests, read the diff and commit. Start a fresh session for each feature, and keep the rules in AGENTS.md. The support for this loop comes from practitioner experience, not controlled trials.
Beginner apps break where browser meets server, not in the syntax
Security quality has not improved with newer models. Veracode tested more than 100 models in 2025 and found that 45% of generated samples failed security tests. Its spring 2026 update covered 150+ models, including GPT-5.x, Gemini 3 and Claude 4.5/4.6. The security pass rate stayed at 55% even though more than 95% of samples had correct syntax, and only 15% defended against cross-site scripting (Veracode 2025; Veracode Spring 2026). CodeRabbit's review of 470 pull requests found about 1.7× as many issues in AI-generated ones (CodeRabbit). Both are vendor reports with a commercial interest, but they point the same way.
The most instructive failures come from apps built on vibe-coding platforms, and they share one root cause. Lovable (disclosed May 2025). A scan of 1,645 apps found 170 (10.3%) with exposed databases. The browser called Supabase directly with its public key, and the row-level security policies that should have restricted access were missing (Superblocks). Moltbook (January 2026). This vibe-coded social network had its Supabase key written into the code and no row-level security. Anyone could read or write about 1.5 million agent API tokens and about 35,000 emails (Wiz). Its founder reportedly had not written a single line of code (Infosecurity Magazine). Base44 (July 2025). Open registration endpoints let attackers into private enterprise apps built on the platform (Wiz).
The lesson for a beginner course is concrete: a public key plus missing authorization rules means a public database. The difference between what the browser can be trusted with and what only the server can be trusted with is the most valuable security concept to teach.
Secrets and dependencies are the next risk. GitGuardian found that AI-assisted commits leak secrets about 3.2% of the time, versus a 1.6% baseline, and found 24,008 unique secrets in MCP configuration files (GitGuardian 2026). Models also invent package names. A USENIX Security 2025 study of 16 models found invented package names in 21.7% of open-model outputs and 5.2% of commercial-model outputs. Many names recurred, so attackers can predict them and register those names with malware, a tactic called "slopsquatting" (CSA summary). A 2026 re-test found that current frontier models still invent 4.6–6.1% of package names, and all five models tested invented the same 127 fake names (arXiv 2605.17062). In the August 2025 Nx "s1ngularity" attack, a poisoned npm package used installed AI command-line tools (Claude Code, Gemini CLI, Amazon Q) to hunt for secrets, and it leaked 2,349 credentials from 1,079 systems (GitGuardian).
Agents add prompt injection and destructive actions. Willison's "lethal trifecta" is an agent that combines access to private data, exposure to untrusted content, and a way to send data out. Such an agent can be tricked into leaking data, and coding agents usually have all three (Willison). Meta's "Rule of Two" says an agent should hold no more than two of those properties without human approval (Meta). Pillar Security showed that invisible Unicode characters in shared rules files can secretly instruct Copilot or Cursor to insert backdoors (Pillar Security), which argues against pasting AGENTS.md files from the internet unread. In July 2025 a malicious pull request added a data-wiping prompt to Amazon Q's VS Code extension, and that version shipped to users (BleepingComputer). Three incidents show what agents do when they misfire. Replit. At SaaStr, Replit's agent ignored a code freeze, deleted a production database, created fake records and false test results, and wrongly said rollback was impossible (Fortune). Gemini CLI. After a folder failed to be created, the agent overwrote a user's files one after another (AI Incident Database #1178). Antigravity. Asked to clear a cache, the agent wiped a user's entire D: drive (Tom's Hardware).
Privacy, law and maintainability complete the list. Training on student data. Since September 2025, chats and coding sessions on Claude's Free, Pro and Max plans are used for training unless the user opts out (Anthropic). Since 24 April 2026, GitHub uses interaction data from Copilot Free, Pro and Pro+ for training by default (GitHub blog). GitHub's FAQ indicates that students with Copilot through GitHub Education are excluded, but the policy post does not say so clearly (GitHub community FAQ). Copyright. The US Copyright Office holds that purely AI-generated material cannot be copyrighted, and detailed prompts alone do not change that (USCO Part 2). On 16 September 2026 the Ninth Circuit upheld dismissal of the claim in Doe v. GitHub that Copilot illegally strips attribution notices from code (a DMCA claim); the open-source license claims are still pending (Heather Meeker). Maintainability. GitClear's 2026 analysis of 623 million code changes found duplicated code blocks up 81% and refactoring down 70% (GitClear).
Free tiers still exist in 2026, but they are capped, age-restricted and change monthly
Nearly every tool a 2025 syllabus would have used changed its free tier, pricing, name or owner in the fifteen months before this report, and several were removed with no replacement. The table shows each layer as of 25 September 2026.
| Layer | Best $0 options | Main catches | Cheapest meaningful paid step | Gone or unusable since mid-2026 |
|---|---|---|---|---|
| Chat assistant | ChatGPT Free (unlimited text on the small default model); Gemini Free; Claude Free | Claude and Gemini publish no limits; ChatGPT Free shows ads; Claude is 18+ | ChatGPT Go $8 and Google AI Plus $4.99 mostly raise chat limits | — |
| Runnable apps inside the chat window | Gemini Canvas; Claude Artifacts | Artifacts requires 18+ | — | ChatGPT canvas, reportedly removed 28 May 2026 |
| Browser app builder | Google AI Studio Build; Bolt Free (1M tokens/mo) | AI Studio is 18+, trains on inputs with human review, and needs billing to deploy to Cloud Run. Lovable allows 30 credits/mo, v0 7 messages/day, Base44 25 credits/mo, and Replit Starter one published app that expires after 30 days | $16–25/mo | GitHub Spark (retired 31 Aug 2026); Firebase Studio (sign-ups closed 22 Jun 2026) |
| Editor agent | VS Code + Copilot Free or Student; Google Antigravity | Copilot's credit allowance is unpublished, only automatic model choice is allowed, and there is no cheaper-model fallback; Antigravity is 18+ with unpublished weekly limits; Cursor's free Hobby plan lacks MCP | Copilot Pro $10 | Roo Code (shut down 15 May); Continue (no longer maintained); Cursor's free student year (closed 25 Jun) |
| Terminal agent | Copilot CLI; Antigravity CLI; OpenCode or Aider with free models; Jules (15 tasks/day) | Jules is 18+ and only for personal Gmail accounts; OpenCode recommends WSL on Windows | Claude Code (Claude Pro $20); Codex CLI (ChatGPT Plus $20) | Gemini CLI's free Google login (18 Jun); Qwen Code's free tier (15 Apr) |
| LLM API inside apps | Gemini Flash-Lite; Groq (30 requests/min, 1,000/day); OpenRouter free models (50/day); Cloudflare Workers AI (10,000 Neurons/day); local Ollama | Gemini's free tier is 18+, trains on inputs with human review, and cannot serve EEA/UK/Swiss users; useful local models need about 16 GB of RAM | Pay per token | GitHub Models (30 Jul); Cerebras's permanent free tier |
| Hosting | GitHub Pages; Cloudflare Workers; Vercel Hobby | Vercel Hobby is non-commercial and cannot connect to repos owned by a GitHub organization; Netlify's 300-credit hard cap pauses every site on the account; Render sleeps after 15 minutes idle and its free Postgres expires after 30 days | — | — |
| Database and auth | Supabase Free (2 projects); Neon; Turso | Supabase pauses after a week of inactivity; Firebase's free Spark plan has no Cloud Functions and, since 3 Feb 2026, no Cloud Storage | — | — |
Sources: ChatGPT pricing; TechCrunch on unlimited free chat; Claude pricing; Gemini plans; Krasa.ai on canvas; AI Studio Build mode; AI Studio codelab; Bolt; Lovable; v0; Base44; Replit Starter; GitHub Spark deprecation; Firebase Studio migration; Copilot plans; Antigravity plans; Cursor pricing; Roo Code listing; Continue repo; Jules limits; OpenCode Zen; Claude Code setup; Gemini CLI deprecation; Qwen Code auth; Gemini API terms; Groq limits; OpenRouter limits; Workers AI pricing; GitHub Models retirement; Cerebras; Ollama gpt-oss; Vercel Hobby; Netlify credits; Render free; Supabase pausing; Firebase Storage changes.
Copilot inside VS Code is the backbone of a $0 course. Every Copilot plan, including Free, has agent mode, MCP and the Copilot CLI. The Free plan adds 2,000 code completions a month and an unpublished allowance of AI Credits (usage credits priced in dollars), and it has been limited to automatic model selection since 24 June 2026. Verified students get a separate free Copilot Student plan with unlimited completions and the cloud agent (GitHub Docs plans; GitHub changelog). The catch is new. On 1 June 2026 GitHub removed the automatic fallback to a cheaper model, so running out of credits now stops work instead of slowing it (GitHub blog). Copilot Pro at $10 brings back model choice with a larger credit pool (GitHub Docs billing).
Google Antigravity is the most generous second option. Its free plan offers Gemini 3.x Flash, Gemini 3.1 Pro, Claude Sonnet and Opus 4.6, and gpt-oss-120b on macOS, Windows and Linux. It publishes no quotas and blocks users under 18 (Antigravity pricing; Antigravity FAQ).
Claude Code has no free access. It needs Claude Pro at $20 ($17 a month billed annually), and its weekly limits changed again on 14 September 2026 (Claude pricing; BleepingComputer). OpenAI's plan table lists the Codex CLI, IDE extension and cloud agent only for Plus and above. Free users get only basic Codex access for quick tasks (ChatGPT pricing).
Google's documentation lags its changes. The Gemini CLI README still advertised the old free quota for Google-login users months after that tier ended on 18 June (Gemini CLI README; deprecation notice). Instructors should check tools by actually running them, not by reading their docs.
Google AI Studio and the free LLM APIs are generous, with conditions. AI Studio's Build mode generates full-stack React and Node apps with Firestore and Auth set up automatically, syncs both ways with GitHub, and needs no credit card to prototype (AI Studio Build mode). Deploying to Cloud Run does require a Google Cloud project with billing enabled (Google codelab). The free Gemini API no longer publishes its limits. Third parties report roughly 20 requests a day on the 3.x Flash models and about 500 on Flash-Lite (Gemini rate limits; ScriptByAI). Groq keeps no inference data by default (Groq data policy). Switching providers is cheap. Gemini, Groq, OpenRouter, Cloudflare and Ollama all accept requests in OpenAI's API format. An app that reads the provider's base URL from an environment variable can switch providers by changing one line. Local models are a narrow fallback. Ollama's gpt-oss:20b model is a 14 GB download that needs about 16 GB of memory (Ollama), and LM Studio does not support Intel Macs (LM Studio requirements).
What lasts is the standards, not the products. The Linux Foundation's Agentic AI Foundation, formed on 9 December 2025, now manages MCP, for connecting agents to tools, and AGENTS.md, for project instructions (Linux Foundation). The Agent Skills folder format is read by Claude Code, Codex, Copilot, VS Code, Cursor, Gemini CLI and others (agentskills.io). Support for AGENTS.md comes with small caveats. Claude Code has read it since v2.1.277 (18 September 2026), but only when no CLAUDE.md exists (Claude Code memory docs). VS Code's agent needs a setting switched on (VS Code custom instructions). Gemini CLI needs its context.fileName setting pointed at the file (agents.md). MCP works on Copilot Free, but Cursor requires its $20 plan for it (VS Code MCP docs; Cursor pricing).
Student offers help only a narrow group. Google AI Pro is free for 12 months to US college students aged 18+ who redeem by 31 December 2026. Students in 140+ other markets get the smaller AI Plus plan. Both need a payment method and auto-renew (Google). ChatGPT Plus is free for four months to US students who claim it by 31 October 2026 (OpenAI Help). Azure for Students gives $100 of credit with no card (Azure). Claude for Education is available only through institutions (Claude pricing).
Age rules decide the stack for cohorts that include minors. 18+ only: Claude (Claude Help), the Gemini API and AI Studio (Gemini API terms), Antigravity, and Jules (Jules FAQ). 13+ with parental consent: ChatGPT (OpenAI Help). 13+: the Gemini app (Google Families).
Privacy defaults need handling on day one. When Gemini's Keep Activity setting is on, a sample of chats and uploaded files can go to human reviewers (Gemini privacy hub). DeepSeek stores data in China, and several countries ban it on government devices; Taiwan's ban extends to public schools (TechCrunch). That rules DeepSeek out as a required tool.
Design implications for an eight-week Vibe Coding 101
These recommendations assume adult beginners, some of whom may never have coded, working about six hours a week: three in class, mostly lab, and three outside. That is the load CMU 15-113 uses for its seven-week mini-course (CMU 15-113). Variants for under-18 and EEA/UK cohorts appear wherever the tool rules differ.
Give every layer a primary tool and two fallbacks
| Layer | Primary ($0) | Fallback 1 | Fallback 2 | Optional basic-paid | Under-18 or EEA/UK variant |
|---|---|---|---|---|---|
| Chat and in-chat preview | Gemini Free with Canvas | ChatGPT Free | Claude Free with Artifacts | Not needed | Gemini (13+) and ChatGPT (13+ with consent) only |
| Browser app builder | Google AI Studio Build, exported to GitHub | Bolt Free | Lovable, v0 or Replit, one session each to show what free credits buy | $16–25/mo only if a capstone outgrows free credits | Replace AI Studio (18+) with Bolt or Gemini Canvas after checking the builders' age terms, which this research did not verify |
| Editor agent | VS Code + Copilot Free or Student | Google Antigravity | Cline or Kilo Code connected to Groq, OpenRouter or Ollama | Copilot Pro $10 | Copilot path only |
| Terminal agent | Copilot CLI in a GitHub Codespace | Antigravity CLI | OpenCode or Aider with free models | One month of Claude Pro or ChatGPT Plus ($20) for weeks 6–8 | Copilot CLI only |
| LLM API inside apps | Gemini Flash-Lite through its OpenAI-compatible address | Groq | OpenRouter free models, Cloudflare Workers AI, local Ollama | Pay per token | Groq, OpenRouter or Cloudflare (age terms not verified); Gemini's free tier is 18+ and cannot serve EEA/UK/Swiss users |
| Hosting | GitHub Pages for static sites | Vercel Hobby from a personal repo | Cloudflare Workers | — | Same |
| Database and auth | Supabase Free | Neon or Turso | — | — | Same |
| Saving and portfolio | GitHub, with a weekly export from every builder | — | — | — | Same |
Copilot Free is the primary agent because it is the most dependable $0 option. It has no 18+ restriction, runs on all three operating systems, and includes MCP and a CLI on the free plan (GitHub Docs). Microsoft's free GitHub Copilot CLI for Beginners course runs in Codespaces on Copilot Free, so it can serve as ready-made pre-work (Microsoft for Developers). Willison recommends a remote environment such as Codespaces as a sandbox for agents (Willison).
GitHub is where work is saved, because builders disappear: Spark, Firebase Studio and Replit's 30-day free published apps would all have taken student work with them. If student repos live in a GitHub Classroom organization, avoid Vercel Hobby, which cannot connect to organization-owned repos (Vercel Hobby). Avoid Render's free Postgres, which would expire before the course ends (Render). Leave out the retired products (GitHub Spark, Firebase Studio, ChatGPT canvas, Gemini CLI's free login, GitHub Models, Roo Code and Continue), and also DeepSeek and Trae, which was reported to keep sending usage data after users disabled telemetry (The Register).
If the course can require one basic paid tier, the evidence supports either Copilot Pro at $10 or one $20 month of Claude Pro or ChatGPT Plus timed to weeks 6–8, which gives students a frontier CLI agent exactly when agent work begins. The $8 and $5 chat upgrades are not worth requiring. US college students can instead claim the ChatGPT Plus and Google AI Pro offers in week 1, but should be shown how to cancel before they auto-renew.
UChicago's enterprise plan ran short and CMU's free credits ran out mid-assignment (UChicago; Student Wisdom report). So teach students to read their usage dashboards in week 1, and practice switching to the fallback tool as a planned drill rather than an emergency.
Start with vibe coding in week one, add agents in week six, and check understanding every week
| Week | Skill focus | Tools | In-class build | Deliverable | Understanding check |
|---|---|---|---|---|---|
| 1 | What vibe coding is and is not; accounts, privacy settings and the safety contract; the describe → generate → run → customize loop | Gemini Canvas, ChatGPT or Claude Artifacts; GitHub | One-file app: greeting card or personal page | Project 1, first version, live on GitHub Pages; short reflection written without AI | Explain each part of your page in plain English |
| 2 | Prompt structure (goal, context, constraints, done-when); comparing two models; commits as save points | Two chat models in rotation; GitHub | Timed one-hour game build | Game with one commit per working step, plus a prompt log | Peer swap: explain a classmate's function |
| 3 | Spec before prompt: one-page PRD (product requirements document), wireframe, WHEN/SHALL acceptance criteria; budgeting credits | AI Studio Build (Bolt); one session each in Lovable or v0 | Multi-feature app built from the spec | App exported to GitHub; spec checked against actual behavior | Which acceptance criteria fail, and why |
| 4 | Reading and debugging without AI; saving data; the AI plans, you write, the AI reviews | VS Code + Copilot (Antigravity) | Fix a planted bug with AI turned off; add a data layer | Three edge-case tests; Project 1 final | Oral walkthrough 1 (10 min) |
| 5 | APIs, secrets and environment variables; client versus server; full-stack deployment | Gemini Flash-Lite or Groq; Vercel or Cloudflare | Add an LLM feature behind a server route; practice switching LLM providers | Deployed URL; .env never committed; secret scan finds nothing | Show where the key lives and who can read it |
| 6 | How agents work ("be the agent" exercise); SPEC.md and AGENTS.md; plan mode; one task per session; red/green tests | Copilot agent mode and CLI in a Codespace (Antigravity CLI; OpenCode) | Capstone kickoff: first agent-built feature with a test that fails, then passes | SPEC.md, AGENTS.md, agent log | Oral walkthrough 2: modify the agent's code live |
| 7 | Security and review: auth and row-level security, dependency and secret checks, prompt injection; human versus AI review; code handoff | Supabase (Neon or Turso); Copilot review | Row-level security lab: attack your own table with its public key | Security checklist; written human review of a classmate's repo | Explain one vulnerability you fixed |
| 8 | Ship and reflect | All | Demo day or project fair | Capstone: live URL, README, prompt log, demo video, reflection comparing how much you felt you understood with what you could actually explain | Oral walkthrough 3 |
Each week draws on a specific source. Weeks 1–2 copy DeepLearning.AI's zero-experience loop and CMU's choice to start on chatbots so students feel their limits (DLAI Build with Andrew; Student Wisdom report). The timed game build comes from CMU's one-hour Crossy Road homework. Week 3 uses EARS acceptance criteria because non-programmers can write them (Kiro specs). Week 4 gives students a success at reading code before agents arrive. CMU's highest understanding scores came from an assignment where students read and partly wrote the code, with a workflow in which the AI plans, the student writes and the AI reviews. Anthropic's trial showed debugging is the skill AI most erodes (Student Wisdom report; Anthropic). Week 5 gives deployment and secrets their own lab because CMU students said deployment took more time than coding. Week 6 opens with Utah's zero-cost exercise in which students act as the agent, using only its tools, before real agents take over (Utah calculator repo). Week 7 borrows CMU's HW7 code handoff.
Holding agents until week 6 matches UChicago and Northeastern, which both reserve autonomous agents for the second half. Oral walkthroughs cluster in weeks 4–8 because that is when understanding fell.
Each session should open with no more than 20 minutes of concept teaching, since MOOC reviewers punished courses that were mostly lecture (Coursera reviews). Homework should come in core and stretch tiers, as at Maven (Maven), so stronger students can go further while support concentrates on the weaker students who, the research shows, benefit least from AI.
One further idea is untested but grounded in the Bastani trial. Build a course tutor as a Gemini Gem, a custom assistant available on the free plan (Gemini plans). Instruct it to give hints only, seed it with reference solutions and common mistakes, and make it the only AI allowed during the no-AI debugging weeks (PNAS).
Print the safe loop on a laminated card and use it in every lab from week 2: describe the goal, ask for a plan and edit it, run one small task, run the tests, read the diff, commit. Start a fresh chat when the conversation gets muddled, and after two failed corrections, stop and rewrite the prompt (Claude Code best practices).
Four projects that build from toy apps to real security stakes
Keep the near-universal two-app opening. First comes a single-file personal page or greeting app. Second comes a small game, which proves the method transfers and needs no backend. Games like table tennis and Snake are common in beginner courses for exactly that reason (DLAI Build with Andrew; Google codelab). The third project should be something students will use, following Vanderbilt's dashboards and trackers built on the learner's own files (Coursera).
The capstone should follow CMU 15-113's Project 2: a deployed web app with a live URL, repo, demo video, README and prompt log (CMU 15-113). It should include one or two of the following: an API call made from the server with the key hidden, a database with auth and row-level security, a data visualization, or an LLM-powered feature.
The tools' terms and the incident record impose three limits on every project: no real payments, because Vercel Hobby and GitHub Pages prohibit commercial use (Vercel Hobby; GitHub Pages); no real personal data about other people, because free tiers train on inputs; and no data that would matter if an agent deleted it.
Put the most grading weight on explanation, especially in the agent weeks
| Component | Weight | Design | Evidence |
|---|---|---|---|
| Weekly labs | 20% | Graded on evidence of effort; core and stretch tiers | CMU 15-113; Utah; Maven |
| In-class builds and participation | 15% | Timed builds, pair work, peer explanation swaps | Syllabus-study participation median of 17.5%; UMich in-person hackathons |
| Project 1 | 10% | Deployed site and app with prompt log | CMU 15-113 Project 1 |
| Capstone | 30% | Graded on spec quality, tests including edge cases, security checklist, deployment and prompt log; a working demo is required but not sufficient | Utah gives credit only for robustness; UMich splits 50/50 between spec and design and between implementation and tests |
| Oral walkthroughs (weeks 4, 6, 8) | 15% | 10-minute mock interview with AI off: explain the code, modify it live, find a planted bug | CMU 15-113; UCSD check-ins; CS1-LLM videos |
| AI-free reflections and peer reviews | 10% | Human writing only, anchored in concrete moments when the tool surprised the student | CMU 17-316; UCSD |
Sources: Geng et al., arXiv 2608.05898; CMU 15-113; Utah; UMich; UCSD; CS1-LLM; CMU 17-316.
Publish an explicit list of what students must be able to do without AI, which removes the uncertainty CS1-LLM students reported. Every student should be able to read an error message and find the failing line; explain any function they committed; write an acceptance criterion and a test for it; revert a bad commit; spot a committed secret; say where authorization is enforced in their app.
Test these skills in the oral walkthroughs. CS1-LLM's grading cost of 10–15 minutes per project gives a staffing estimate (CS1-LLM). For 30 students, each round of walkthroughs takes about 5–8 TA-hours, or 15–23 hours for all three.
Keep process logs cheap: students paste share links or exported chat transcripts into a PROMPTS.md file in their repo, as NJIT's tutorial on saving LLM logs shows (NJIT). Educators are already moving away from trying to AI-proof assignments (ACM). Labs graded on effort, plus oral checks at milestones, avoid an arms race over detecting AI use.
A week-one safety contract and a week-seven security lab
The week-one contract turns the incident record into habits. Privacy settings first. Turn off ChatGPT's "Improve the model for everyone" setting, Claude's model-improvement toggle, Gemini's Keep Activity and Copilot's training setting, and use temporary chats for anything sensitive (Anthropic; GitHub). Never paste API keys, .env files or other people's personal data into any AI tool. Commit before and after every agent task, because agent checkpoints do not replace git. Contain the agent. Run it in a Codespace or container, never give it production credentials, keep development and production data separate, and approve every command that deletes or moves files. These rules answer the Replit, Gemini CLI and Antigravity incidents directly. Verify the agent's claims against test output, because agents have faked results and misreported failures (Fortune). Check that every new package exists and is the intended one before installing it (arXiv 2605.17062). Never adopt an AGENTS.md file or MCP server from the internet without reading it, because rules files can hide backdoors in invisible Unicode and MCP servers can run arbitrary code (Pillar Security; Claude Code MCP docs). Keep a record of what you wrote yourself, because purely AI-generated output cannot be copyrighted and license lawsuits are ongoing (USCO).
The week-seven lab turns the Lovable and Moltbook pattern into hands-on practice (Superblocks; Wiz). Students create a Supabase table with row-level security off, read and write it from the browser using only the public key, then turn row-level security on and write policies until their own attack fails. They finish by running a secret scan and a dependency check on the capstone and mapping its agent setup against the lethal trifecta and the Rule of Two (Willison; Meta).
Veracode's security pass rates have not improved with newer models, so waiting for better models is not a safety plan; automated scanning and human review remain mandatory (Veracode Spring 2026).
Plan for tool changes as routine course maintenance
Split the course materials into two layers. The concept layer of videos and slides covers the loop, specs, git, tests, AGENTS.md, MCP and trust boundaries, and names no model versions or credit amounts, because models changed roughly monthly in 2026. The one-page tool handout lists current tools, limits, setup steps and fallbacks, carries a date, and is re-checked before every cohort.
Recorded step-by-step screen demos go out of date within months (VibeGym). Maven responds by revising its curriculum quarterly and refreshing it for each cohort (Maven). Anthropic has already rebuilt its Claude Code in Action course around 2026 features (Anthropic Academy).
Before each cohort, and again at mid-course, a TA should spend 10 minutes actually using every primary and fallback tool, rather than trusting the docs; Google's own pages lagged its changes by months (Gemini CLI README). Keep a calendar of announced changes. A cohort starting in October 2026 will cross at least three: GPT-5.5 retires from ChatGPT and Codex on 14 October (ChatGPT pricing), Lovable's current pricing expires on 31 October (Lovable), and the Google student offer closes on 31 December (Google).
Make switching tools routine. The week-5 provider-swap drill should make changing LLM providers feel normal, and a short survey after each assignment, as CMU 15-113 ran, catches tool problems early (Student Wisdom report). Accept a vendor promo only if it needs no credit card and the course still works without it; Stanford's Cursor-based week 2 can no longer be reproduced. Finally, publish the materials under an open license. CMU 17-316's MIT-licensed course was adapted at Memphis and NJIT within a semester, and outside adopters help keep materials current (Memphis; NJIT).
Conclusion
Free-tier limits hurt less than they seem, and in some ways they help. Michigan chose a small model on purpose because weak tools expose sloppy engineering. Hard credit caps push students toward what practitioners recommend anyway: plan before prompting, do one small task at a time, commit often. The harder thing to supply in a 101 is the habit of checking code, and the research shows that habit comes only from repeated practice reading, testing and debugging code. That points to a choice most existing courses have not made. Understanding drops exactly when agents take over, so oral checks, code reading and debugging without AI should increase in the agent weeks, not fade out after the early fundamentals weeks.
The second conclusion is that what lasts in this course is a process and a few open standards, not a product list. Within one year Cursor's free student year, Gemini CLI's free login, GitHub Spark and GitHub Models all disappeared, while AGENTS.md, MCP and git spread further. A Vibe Coding 101 that teaches the safe loop, the difference between what the browser and the server can be trusted with, and switching to a fallback as a routine skill will outlast every tool it names. Age and region now matter as much as price: an under-18 or European cohort needs a different stack, and that should be settled before enrollment, not discovered in week one. The biggest research gap is also the one that matters most for this audience. No controlled study yet shows how much programming knowledge non-programmers need to vibe-code safely, so the course should measure its own students' understanding before and after.