Vibe Coding on Android: What Google AI Studio Can Do Today

Vibe Coding on Android: What Google AI Studio Can Do Today

Google's AI Studio now runs in any mobile browser, and as of two months ago, the Antigravity agent can provision a database, store API keys, and set up authentication without any code from the user. There is no dedicated Android app, and the interface was built for a desktop. But vibe coding on Android is functional today, and the distance between what has shipped and what is still on the roadmap carries more weight than a typical product gap.

Andrej Karpathy coined "vibe coding" in February 2025 to describe a workflow where you describe what you want and let an AI generate everything underneath, "forget that the code even exists," as the Cloud Security Alliance noted in its summary of his approach. By November 2025, Collins English Dictionary had named it word of the year, citing a dramatic uptick across its 24-billion-word corpus, according to the same source. Google's stated goal, "lower the barrier between a great idea and a working app with Gemini, so anyone can build with AI," is a direct pitch to people who have never opened a code editor. Getting there took seven months.

How Google assembled the platform

Google got here in four steps, between last October and two months ago.

In October 2025, Google introduced a new vibe coding experience inside AI Studio designed to take users "from prompt to working AI app in minutes," with automatic model wiring and API handling, Google announced. The pitch was direct: people who have never written a line of code could bring their ideas to life. A month later, Gemini 3 launched with vibe coding as a headline capability. By improving complex instruction following and deep tool use, Google said, the model could translate "a high-level idea into a fully interactive app with a single prompt." The Gemini consumer app was updated at the same time, with Google calling Gemini 3 its "best vibe coding model ever" and promising that apps built in Canvas would be more full-featured, per the Gemini app announcement.

Gemini 3 Flash followed in December 2025, rolling out across Android Studio, AI Studio, and Antigravity simultaneously. Priced at $0.50 per million input tokens and running three times faster than its predecessor based on Artificial Analysis benchmarking, with context caching capable of cutting costs by up to 90% in repeated-use scenarios, it changed the unit economics of persistent AI coding assistance. Those numbers matter because they make this category viable for casual users, not just enterprise teams running dedicated budgets.

The March 2026 update completed the backend layer. The Antigravity agent can now detect when an app needs a database or login system, propose a Firebase integration, and after user approval, provision Cloud Firestore and Firebase Authentication automatically. A new Secrets Manager stores API credentials without surfacing them to the user, Google explained. Google reports this tooling has already been used internally to build hundreds of thousands of apps, a figure the company has not made available for independent verification.

What vibe coding on your phone looks like right now

The experience splits in practice along two tracks.

For developers, Gemini 3 Flash is integrated into Android Studio and the Antigravity platform, available since December. For non-developers, the Gemini app offers two relevant surfaces: Canvas, which Google says produces more full-featured apps when powered by Gemini 3, and Gemini Agent, an experimental feature that handles multi-step tasks by connecting to Calendar, Gmail, and live web browsing. Google designed the agent to seek confirmation before irreversible actions like purchases or sending messages, according to the Gemini app announcement.

AI Studio also works directly from a mobile browser. The workflow: type a description of an app, then step through the Antigravity agent's proposals, framework selection, database provisioning, login setup, approving each stage. Sessions persist across devices; close the tab and the project resumes where it left off, per Google. The multi-column layout and embedded code panel were not designed for a phone screen. The tool runs. The ergonomics belong to a different product category.

Three features that would meaningfully close that gap have not shipped: one-click deployment from AI Studio to Antigravity, Workspace integrations for Drive and Sheets, and any phone-native creation surface within the Gemini app. Google has said it is working on all three. Each one removes a step between a casual user and a live, deployed application, which is precisely why the security layer underneath deserves scrutiny before they arrive.

The risk grows as the audience broadens

The research on AI-generated code applies to the category broadly, not to Google AI Studio specifically. That scope matters. What follows describes documented risks in AI-assisted development generally, risks that become harder to manage as the intended audience shifts away from people who can read the output.

A JetBrains survey of more than 24,500 developers across 194 countries found that 85% already use AI coding tools regularly, the Cloud Security Alliance reported last month. Google's "anyone can build" pitch targets a different group entirely, people with no framework for evaluating what an AI generated on their behalf.

The output those users would receive carries documented risks. Veracode tested more than 100 large language models and found that 45% of AI-generated code samples introduced OWASP Top 10 vulnerabilities, a rate that did not improve through multiple testing cycles from 2025 into early 2026 despite model upgrades, according to the Cloud Security Alliance. Among developers who can at least read the output, empirical research across Fortune 50 enterprises found that AI-assisted teams commit code three to four times faster than peers but introduce security vulnerabilities at ten times the rate, accumulating a backlog that outpaces remediation, the same source noted.

One failure mode lands hardest on users who cannot inspect what they are running. Roughly one in five AI-generated code samples references packages that do not exist. Attackers exploit this hallucination pattern by registering those invented names as malicious software before any developer notices, a technique researchers call "slopsquatting," the Cloud Security Alliance noted. Georgia Tech's Vibe Security Radar tracked 35 CVEs in March 2026 alone directly attributable to AI coding tools, with researchers estimating the true count is five to ten times higher across the broader open-source ecosystem. A developer scanning a dependency list has some chance of catching a suspicious package name. Someone who described an app in plain language and tapped through whatever the agent proposed has no equivalent check.

Google's mitigations are genuine product features, not cosmetic ones: the Secrets Manager, mandatory user approval before backend provisioning, and Firebase Authentication were built as functional guardrails, as described in the March announcement. Whether those guardrails perform adequately when a non-technical user approves every agent prompt without understanding what is being provisioned is a question the current evidence does not answer. No independent audit of the platform's security outcomes for novice users has been published.

What to try, what to watch

For Android developers, Gemini 3 Flash is live in Android Studio and Antigravity. For non-developers, the Gemini app's Canvas feature is the most phone-accessible entry point Google currently offers. AI Studio via mobile browser functions, but it was built for a keyboard, and that distinction is not a minor quibble.

Three developments are worth tracking: one-click deployment from AI Studio to Antigravity; Workspace integrations connecting Drive and Sheets to AI-built apps; and a phone-native creation surface inside the Gemini app, all flagged as in-progress by Google. Each one shortens the distance between a plain-language description and a deployed application.

The most consequential open question is the last one on that list. A native Android creation surface, if it ships, would be the moment vibe coding on Android stops being a browser workaround and becomes a first-class mobile experience. Google has not said when, or confirmed it is coming at all. Until then, the platform is being assembled at a visible pace for an audience that is explicitly non-technical, and what nobody outside Google has demonstrated yet is whether the guardrails hold when the people relying on them have no way to know when they have not.