The Code Works. Nobody Owns It. Vibe Coding and the Human-Authorship Rule.

You described the program, the AI wrote it, and it works. Under the human-authorship rule, you may not own it.

The short answer

In February 2025, Andrej Karpathy, a co-founder of OpenAI and the former head of AI at Tesla, gave a name to a practice many developers had already adopted. He called it "vibe coding": describing what you want to an AI coding tool in plain English, accepting the code it returns, pasting in the error messages when the program breaks, and repeating until it does what you asked. In his description, you "forget that the code even exists." You judge the result by whether it runs, not by what the code says.

Twenty months later, real products are built this way. Startups ship vibe-coded applications. Business owners with no programming background build their own internal tools. Lawyers, accountants and consultants build their own utilities. The code often works. The question this post addresses is who owns it.

Under current United States law, the answer is unfavorable to the vibe coder. Copyright requires a human author, and that author must be the source of the expression copyright protects. In software, the protected expression is the code itself: the specific lines, structures and arrangements a programmer writes. When a person supplies only a description and the machine supplies the code, the Copyright Office's position is that the resulting code is not protected by copyright at all. A federal appeals court has adopted the underlying rule, and the Supreme Court declined to review that decision. A company can sell a vibe-coded product. It may have no way to stop a competitor from copying it.

In Part 1 of our series on AI decompilation, we noted that an AI-built reimplementation of someone else's software "may belong to no one." The same rule applies to a growing share of all new software, and this post explains why.

The rule is older than the computer

The Constitution authorizes Congress to secure to "Authors" the exclusive right to their "Writings." Courts have always read "author" to mean a human being.

The camera case. The foundational decision is Burrow-Giles Lithographic Co. v. Sarony, 111 U.S. 53 (1884). A lithographer copied a photograph of Oscar Wilde and argued that no photograph could be copyrighted, because the camera, not the photographer, made the picture. The Supreme Court rejected the argument on a ground that matters here. The photographer had posed Wilde, chosen the costume and drapery, arranged the light and shade, and "evoked the desired expression." The camera was a tool that recorded those choices. The author was the person who conceived the image and directed its expression, not the machine that fixed it. The Court left open whether a purely mechanical photograph, with no such intellectual contribution, would qualify.

That reasoning has governed every creative technology since. Word processors, synthesizers, rendering engines and compilers are tools. They do not become authors because they do the physical work of fixing the expression. The person remains the author as long as the person makes the creative choices.

The monkey case. The rule also applies when the candidate author is not human. In Naruto v. Slater, 888 F.3d 418 (9th Cir. 2018), an animal rights organization sued on behalf of a crested macaque that had photographed itself with a wildlife photographer's camera. The Ninth Circuit held that the monkey lacked statutory standing under the Copyright Act. The Copyright Office had already reached the same conclusion in its Compendium of practices, which states that the Office will register an original work "provided that the work was created by a human being," and will not register works "produced by a machine or mere mechanical process that operates randomly or automatically without any creative input or intervention from a human author."

The AI case. Stephen Thaler, a computer scientist, applied to register an artwork titled "A Recent Entrance to Paradise," listing his AI system, the "Creativity Machine," as the sole author and himself as the owner. The Copyright Office refused. The district court affirmed, and in Thaler v. Perlmutter, 130 F.4th 1039 (D.C. Cir. 2025), the D.C. Circuit agreed: the Copyright Act requires that a work be authored in the first instance by a human being, and a machine cannot be an author. On March 2, 2026, the Supreme Court denied Thaler's petition for certiorari (No. 25-449), leaving the decision in place.

Thaler was an easy case by design. Thaler disclaimed any human contribution in order to present the pure question of whether a machine can be an author. The difficult cases are those in which a human and a machine both contributed and the question is whether the human contributed enough. Vibe coding is one of those cases.

Why a prompt is not authorship

The Copyright Office addressed the mixed cases in its March 2023 registration guidance and, in more detail, in Part 2 of its report Copyright and Artificial Intelligence, titled Copyrightability, released in January 2025. That report supplies the framework that applies to vibe coding today. Four of its conclusions do most of the work.

The test is control over expression. The Office asks whether the human exercised sufficient control over the expressive elements of the work. Causing the work to exist is not enough. The person who commissions a painting is not its author, and the person who asks a machine for a program is in a comparable position unless more is shown.

Prompts alone do not provide that control. This is the conclusion that matters most. In the Office's view, with the generally available technology it examined, a prompt is an instruction that conveys an idea. The AI system decides how to express that idea, and the same prompt can produce a different output each time it runs. Ideas are not copyrightable, 17 U.S.C. § 102(b). The Office concluded that neither writing the prompt nor choosing one output from several makes the user the author of the expression the machine produced. It left open the possibility that future systems will give users more direct control. It did not find that any current system does.

Repeated prompting does not change the result. Vibe coding is iterative. The user runs the program, reports the failure and asks for a fix. The Office considered the argument that repeated prompting amounts to authorship and rejected it. Each prompt is another instruction, and the machine answers each one in its own way. Describing the result you want more precisely is still describing, not writing.

Some human contributions remain protectable. The report identifies three categories of human contribution that can support a copyright claim in a work containing AI-generated material: the human's own expression where it remains perceptible in the output (for example, text the user wrote and the model edited), the creative selection, coordination or arrangement of AI-generated material, and creative modifications of the output that meet the originality threshold on their own. Protection covers those contributions and not the AI-generated material around them. The analysis is case by case, and the Office recommended no new form of protection for purely AI-generated output.

Code is not a special case. Computer programs are protected as literary works, 17 U.S.C. § 101, and the same human-authorship rule applies. The rule bites harder for software. Software copyright has never covered a program's function, methods or algorithms, § 102(b). What remains, the literal code and some of its structure, is what the vibe coder delegates to the machine.

Applied to the practice as Karpathy described it, the framework yields a clear result. The user supplies ideas in natural language. The model writes every line. The user tests behavior and does not read the code. Nothing in that process places human expression in the code, modifies the code creatively or arranges it. On the Office's stated view, the resulting source code lacks human authorship, and code that lacks human authorship is not copyrightable.

Two qualifications apply. First, the Office's report is guidance rather than binding law, and no appellate court has decided a case about AI-assisted source code. Thaler held only that a machine cannot be an author. It did not decide how much human contribution is enough. Second, most real projects are mixtures. A developer who reads, revises, rejects and restructures the tool's output is in a different position from a person who never looks at the code. The term "vibe coding" covers a range of practices, and the copyright analysis follows the facts rather than the label.

What the vibe coder is left with

A product whose source code is largely uncopyrightable still has legal protection. The protection comes from sources other than copyright in the code.

A narrow copyright in the whole. Even where every function was machine-written, a person who decided which features to build, how to divide the program into modules and how those modules fit together may own a copyright in that selection and arrangement. The protection is real but limited. Under Feist Publications, Inc. v. Rural Telephone Service Co., 499 U.S. 340 (1991), a copyright in a compilation covers only the original selection and arrangement, and infringement generally requires near-identical copying of that arrangement. A competitor who copies the functions and rearranges them has, in most cases, taken nothing the law protects. The Copyright Office's own decisions show the limit. In the Zarya of the Dawn matter in February 2023, the Office registered a graphic novel's text and the author's selection and arrangement of AI-generated images, but excluded the images themselves.

Copyright in what a human wrote or rewrote. Any module the developer drafted, any AI output the developer substantially rewrote and any creative modification that meets the ordinary originality threshold remains protectable. In a mixed codebase, the value of that protection depends on whether anyone can later identify which parts a human wrote. That is a record-keeping problem as much as a legal one.

Trade secret law, with the limits described in Part 2. Copyright and trade secret protection are independent. Source code that is never disclosed can be a trade secret under the Defend Trade Secrets Act, 18 U.S.C. § 1836, and Florida's Uniform Trade Secrets Act, chapter 688, Florida Statutes, whether or not it is copyrightable, as long as the owner takes reasonable measures to keep it secret. For a hosted application, that is a strong position. For software shipped to customers as a binary, the analysis in Part 2 applies: what a competitor can learn by decompiling a lawfully acquired copy is not a secret against that competitor, and AI has made decompilation inexpensive.

Contracts. A license agreement binds the people who accept it whether or not the licensed code is copyrightable. Terms prohibiting copying, redistribution and reverse engineering remain enforceable as contracts, and a breach of contract claim does not require proof of authorship. A contract provides no remedy against a stranger who obtains the code without agreeing to anything.

Trademarks, trade dress and patents. The product's name, logo and distinctive interface are protected independently of the code. A genuinely inventive technique may be patentable, and patent infringement does not depend on who, or what, wrote the code that practices the invention.

Open source licensing is affected in both directions. Open source licenses are copyright licenses. A project that releases vibe-coded software under the GPL, the MIT license or any other license is purporting to license rights it may not hold. If the code is uncopyrightable, the license conditions (attribution, copyleft, patent grants) have nothing to attach to, and a downstream user who ignores them may breach nothing. The reverse problem is also unresolved. AI coding tools were trained on large quantities of licensed open source code, and an output that reproduces a protected portion of that code may carry the original license with it. In Doe v. GitHub, Inc., No. 24-7700 (9th Cir. Sept. 16, 2026), the Ninth Circuit held that GitHub Copilot's outputs are new works rather than copies from which copyright management information was removed, which defeated the plaintiffs' claim under 17 U.S.C. § 1202(b). The court expressly left ordinary infringement claims undecided.

The business consequence. A vibe-coded business holds a copyright in its code that is narrow or absent. Its trade secret protection for shipped code is weakening. Its contracts reach only its own customers. Its strongest protections are the logic it keeps on its own servers and its brand. That is the same conclusion Part 2 reached for conventionally written software after AI decompilation. Vibe coding reaches it sooner, because it removes copyright protection when the code is created rather than when a competitor decompiles it.

How to build software you can own

Current law offers no way to make purely machine-written code copyrightable. It does offer ways to ensure that the code you care about is not purely machine-written, and to prove it later.

1. Decide what you need to own before you start. Most of a modern application is configuration, boilerplate, connecting code and standard integrations that no competitor would pay to copy and no owner needs to protect. The machine can write those. Identify the parts that carry the product's value, such as the core logic and the data model, and treat them differently.

2. For the parts that matter, use the AI as a drafting assistant, not an author. Read the output. Rewrite it. Restructure it. Reject what you do not want and replace it with your own work. The Copyright Office's framework protects human expression that is perceptible in the result and creative modifications of the output. A review that leaves the code unchanged adds nothing. A review that changes the expression does.

3. Own the architecture. The division of the program into components, the interfaces between them and the overall structure are decisions the developer can make, and the selection and arrangement of material is one of the three categories the Office recognizes. Make those decisions yourself, record them, and require the machine to conform to them.

4. Keep the record you will need in a dispute. Preserve the prompts, but prompts alone will not establish authorship. Preserve the diffs showing what you changed after the model wrote it, the design documents you wrote before the model started, the notes explaining why you chose one approach over another, and the version history. In litigation, the opposing party will argue that the machine determined every expressive choice. Contemporaneous evidence of human creative control is the only answer to that argument.

5. Register accurately. The Copyright Office requires applicants to disclose AI-generated material that is more than de minimis. Use the Standard Application, describe only the human contribution in the "Author Created" field, and exclude the AI-generated material in the Limitation of Claim section. An application that claims the whole program as human-authored when it was not invites a challenge to the registration, and a registration obtained with knowingly inaccurate information can be invalidated under 17 U.S.C. § 411(b).

6. Protect the code as if it had no copyright. Keep the valuable logic on servers you control. Require customers to accept license terms that prohibit copying and reverse engineering. Maintain the secrecy measures trade secret law requires. Register the trademarks. None of those protections depends on human authorship.

7. Audit what you have already built. Companies that have been vibe coding for a year or more may own products whose copyright status they have never examined. A review that separates human-authored components from machine-generated ones, while the people who built them still remember which was which, costs far less than reconstructing that history in discovery.

8. Review your development contracts. An assignment of "all copyright in the work product" from a contractor who vibe-coded the deliverable assigns whatever copyright exists, which may be very little. Development agreements should specify how AI tools may be used, require documentation of human contribution, and allocate the risk that portions of the deliverable are unprotectable.

What remains undecided

No court has applied the human-authorship rule to a mixed, AI-assisted codebase and said how much human contribution is enough. The Copyright Office's conclusion that prompts alone do not confer authorship is agency guidance, not binding law, and it depends on the state of the technology the Office examined. Tools that give developers finer control over the expression of the output could change the analysis for those tools. Congress could legislate, although the Office has advised against it. And the infringement questions about AI coding tools, whether their outputs reproduce protected code from their training data and whether that reproduction is fair use, remain open after Doe v. GitHub.

The rule itself is not in doubt. For 140 years, American copyright has protected the choices of a human author fixed through a tool, and nothing else. Vibe coding is a decision to leave those choices to the tool. The decision saves time and money. Its cost appears when a competitor copies the product and the owner learns that the code running the business was never protectable.

Sources

U.S. Const. art. I, § 8, cl. 8; 17 U.S.C. §§ 101, 102, 411(b), 1202(b).

Burrow-Giles Lithographic Co. v. Sarony, 111 U.S. 53 (1884); Feist Publications, Inc. v. Rural Telephone Service Co., 499 U.S. 340 (1991); Naruto v. Slater, 888 F.3d 418 (9th Cir. 2018); Thaler v. Perlmutter, 130 F.4th 1039 (D.C. Cir. 2025), cert. denied, No. 25-449 (U.S. Mar. 2, 2026); Doe v. GitHub, Inc., No. 24-7700 (9th Cir. Sept. 16, 2026).

U.S. Copyright Office, Copyright Registration Guidance: Works Containing Material Generated by Artificial Intelligence, 88 Fed. Reg. 16190 (Mar. 16, 2023); U.S. Copyright Office, Copyright and Artificial Intelligence, Part 2: Copyrightability (Jan. 2025); U.S. Copyright Office, Compendium of U.S. Copyright Office Practices § 313.2 (3d ed.); U.S. Copyright Office, letter re: Zarya of the Dawn (Registration No. VAu001480196) (Feb. 21, 2023).

18 U.S.C. § 1836; sections 688.001 to 688.009, Florida Statutes.

Andrej Karpathy (@karpathy), post coining "vibe coding," X (Feb. 2, 2025); Simon Willison, "Not all AI-assisted programming is vibe coding (but vibe coding rocks)" (Mar. 19, 2025).

Disclaimer

This post discusses publicly reported legal developments for general informational purposes. It is not legal advice, it does not create an attorney client relationship, and it does not reflect the firm's position in any pending matter. Outcomes depend on the specific facts and the governing law of the relevant jurisdiction.