Thinking of Vibe Coding a CRM? What AI Can Build, Where It Breaks, and What It Really Costs (2026)

Ask an AI coding tool to “build me a CRM” and by the end of the afternoon you will have something that looks like one: a contacts table, a deals board, a login page, maybe a dashboard. It is a genuinely impressive demo. Whether it can run your business is a different question, and the answer depends less on the AI than on the parts of a CRM nobody sees in a demo.

We build DoubleScale, a CRM, so we have an obvious interest in this question. We also write our own code with AI tools every day, which is why we can be specific about where they shine and where they cost you. This guide explains what vibe coding is, which parts of a CRM it handles well, where the business logic gets hard, and, with the calculator below, what a vibe-coded CRM really costs in tokens, money and time.

Disclosure: DoubleScale is our product. AI prices come from Anthropic’s published pricing on October 24, 2026; the size estimates are ours and every one of them is editable in the calculator.

What is vibe coding?

The term comes from AI researcher Andrej Karpathy, who described it in a post on X on February 2, 2025: you describe what you want in plain language, accept the code the AI writes without reading it closely, and when something breaks you paste the error back and let the AI fix it. Martin Fowler’s summary captures the key idea: you stop paying attention to the code itself.

Today that happens in coding agents such as Claude Code and Cursor, which edit files in your project, and in app builders such as Lovable, Bolt and Replit, which also host the result. The tools are excellent. The question is not whether they can write code, but whether code nobody has read can carry your customer data, your sales process and your invoices.

It helps to separate two things that look the same from the outside:

• Vibe coding: you judge the result by whether it seems to work. Fast, fun and great for prototypes.
• AI-assisted engineering: a developer specifies, reviews, tests and owns the code, and uses AI to write it faster. Slower, and the only way we know to ship software that handles money and personal data.

What vibe coding builds well

A lot of a CRM is standard screens and data, and AI is very good at standard:

• Tables of contacts and companies with search, sorting and filters.
• A kanban board for deals, with drag and drop between stages.
• Forms, detail pages and a simple dashboard with counts and charts.
• Importing a clean CSV file.
• One-person tools: a tracker for your own leads that only you use.
• Glue code: a script that moves data between two tools you already have.

If that list is your whole CRM, vibe coding is a reasonable way to get it. Most businesses discover that it is only the visible part.

Where a CRM gets hard: the business logic AI will not think of for you

An AI writes what you ask for. A CRM’s hardest work is in the things nobody thinks to ask for until a customer complains. These are the areas where we spend most of our own engineering time.

1. Who can see what

A salesperson should see their own deals, a manager the team’s, a client only their own invoices in a portal. Permissions have to be enforced on the server for every request, not hidden in the interface. This is exactly where AI-built apps leak: in 2025, a researcher found that about 170 apps built with Lovable let anyone read or change data in their databases because access rules were missing (CVE-2025-48757).

2. Email that actually arrives

Sending one email is easy. Sending a campaign that reaches inboxes means SPF, DKIM and DMARC, handling bounces and spam complaints, one-click unsubscribe headers, provider rate limits, and keeping a record of consent so you can prove it under GDPR or CAN-SPAM. Get it wrong and your domain lands in spam folders, including for the emails you send by hand.

3. Automations that never double-send

“When a lead fills the form, wait two days, then send email two” sounds simple. In production it has to survive server restarts, retries, time zones, a contact who unsubscribes during the wait, and a provider’s daily limit. When a workflow ran for a list of 100,000 contacts, we had to build a send queue with shared daily limits so messages wait and resume instead of failing or sending twice. A vibe-coded automation usually discovers these cases in front of customers.

4. Money

Quotes and invoices need sequential numbering, tax rules, rounding that matches your accountant, partial payments, credit notes, multiple currencies, and in some countries e-invoice formats such as XRechnung. A rounding bug in a demo is a curiosity; in an invoice it is a legal problem.

5. Data that stays correct

Duplicate contacts, merges that keep history, imports from messy spreadsheets, custom fields, and database migrations when your data model changes. Every change to a live CRM has to move existing data safely, and AI agents can be destructive: in July 2025, Replit’s agent deleted a user’s database during a declared code freeze and then misreported whether it could be recovered.

6. Security and privacy

Veracode tested code from more than 100 language models on 80 tasks and found security flaws in 45% of cases; the models failed to prevent cross-site scripting 86% of the time (Veracode, July 2025). A CRM stores names, emails, phone numbers and often notes about people, so it also needs data export and deletion on request.

7. Running it for years

Backups you have restored at least once, updates to every library you use, monitoring, and performance when 500 contacts become 100,000. None of this shows up in a prototype, and all of it is your job once the CRM is yours.

What separates a CRM demo from a CRM you run a business on.

The risks of vibe coding your CRM

• You cannot fix what you never read. When the AI cannot solve a bug, someone has to understand the code. If nobody does, the project stops.
• Every change gets more expensive. The bigger the codebase, the more the AI has to read before each change, so tokens per fix grow as the CRM grows.
• Security holes stay silent. A leak does not crash anything; you find out when someone else does.
• Data loss is permanent. Separate development and production databases and tested backups are not optional.
• Compliance is on you. GDPR requests, consent records and email rules apply to your CRM the same way they apply to commercial ones.
• The bus factor is one. If the person who prompted it leaves, so does the only knowledge of how it works.

Can a vibe-coded CRM ever be production-ready?

For a simple app, often yes: a booking form, an internal tracker or a landing page can go from prompt to production with little more than testing. A CRM is different, because its value is in business rules that interact: a deal stage triggers an automation, which sends an email, which must respect consent, which depends on who owns the contact and which permissions apply. Each rule is easy to describe and hard to get right in every combination.

That is why the second stage in the calculator is not “keep prompting”. It is a different job, done by someone with technical skills:

• Writing down the rules. What happens when a contact unsubscribes mid-sequence, an invoice is partly paid, or two people edit the same deal.
• Reading and testing the code the AI wrote, and adding automated tests so a fix in one place does not break another.
• Checking the business logic against real cases, not just whether the screen loads.
• Fixing what users find. Bugs keep arriving after launch, so this never fully ends.

Our estimate for that work is about 30 hours per 1,000 lines of finished code, roughly 270 tested lines a day even with AI writing them. It is an estimate, not a measurement, and you can change it in the calculator; in our experience the risk is that it is too low, not too high. Without someone in that role, a vibe-coded CRM does not become production-ready; it stays a prototype that people depend on.

How much does it cost to vibe code a CRM?

AI coding tools are billed in tokens, roughly three to four characters of text each. Building software costs more tokens than the code you end up with, for three reasons: code is rewritten several times before it works, models think before they write (billed as output), and a coding agent re-reads files and conversation history on every step. In Anthropic’s own example of a short Claude Code session, the model read about 940,000 cached tokens to write 5,300 (Claude Code costs documentation).

The calculator turns that into numbers for your CRM. It defaults to six core modules and Claude Opus 5.5; change anything.

The worked example

With the six default modules (35,000 lines of finished code by our estimate), the calculator gives:

Output tokens and AI cost at Anthropic list prices, October 24, 2026, using the calculator defaults. Context tokens (re-read and cached) are priced in.

Three things stand out:

• The prototype is cheap. About $59 of Opus 5.5 and around 28 hours of your time. This is why vibe-coded CRM demos are everywhere.
• Hardening costs tokens, but mostly developer time. About $564 of AI, and roughly 1,050 hours of developer work to specify, test, fix and check the business rules. At $50 an hour, the first year comes to about $53,304 with $20 a month of hosting.
• A full CRM is a different project. All 13 modules (73,000 lines) come to about $1,177 of AI and 2,190 hours, more than a year of full-time work, before email sending services, SMS fees or support.

As a sanity check, Anthropic reports that Claude Code users spend about $13 per active day on average, with 90% under $30 (Anthropic). 1,050 hours is roughly 131 working days, or about $1,706 at that average. Either way, the AI bill lands between a few hundred and a couple of thousand dollars; the hours are what decide the project. If you use a subscription instead, Claude Pro is $20 a month and Max starts at $100 a month, with usage limits that a project this size will reach.

For scale: DoubleScale’s free and Pro plugins together are about 880,000 lines of PHP and TypeScript, built over more than 4,600 commits since April 2024. Writing that much code once, with no rewrites, is about 9 million output tokens.

The smarter path: vibe code on top of a CRM, not instead of one

The parts of a CRM that are the same for every business (contacts, pipelines, email, automations, invoices, permissions) are the expensive parts to get right and the least valuable parts to rebuild. The parts that are unique to you, such as a custom report, a special intake flow or a connection to your own system, are small and are exactly where AI coding shines.

• Start from an open-source CRM. DoubleScale is a free, GPL-licensed CRM for WordPress, so you host it, own the data and can read every line. The free plugin includes unlimited contacts, email campaigns, automations, booking, proposals, invoices, a helpdesk and a client portal. Pro starts at $99 a year and adds pipelines, SMS and WhatsApp, contracts and projects.
• Vibe code the edges. Build the custom pieces as a small WordPress plugin around it, where a bug cannot take down the core.
• Let AI work with your data, not your schema. DoubleScale includes an MCP server, so assistants such as Claude, Cursor and Codex can read and update CRM data through the CRM’s own rules.

Because DoubleScale is modular, you switch off what you do not need, so you are not paying in complexity for features you never use.

When vibe coding your own CRM does make sense

• Your data model is not contacts and deals at all, and no CRM fits it.
• It is a one-person tool with no customer-facing email, payments or portal.
• You are a developer who will read, test and maintain the code, which makes it AI-assisted engineering rather than vibe coding.
• The CRM is part of the product you sell, so owning it is the point.
• It is a learning project, and losing the data would not hurt anyone.

If you build it anyway: a checklist

1. Write a one-page specification of your data model and permissions before the first prompt.
2. Keep development and production databases separate, and test a backup restore.
3. Ask for automated tests with every feature, and run them before every change.
4. Send email through an established provider, with SPF, DKIM and DMARC set up.
5. Never store card numbers; use a payment provider’s hosted checkout.
6. Have someone who reads code review authentication, permissions and anything touching money.
7. Budget for maintenance from day one, in tokens and in your time.

Comparing ready-made options?See our guides to cheap CRMs for small business, the simplest CRMs to set up and the best WordPress CRM plugins.

How we estimated: AI prices are Anthropic’s list prices on October 24, 2026 (claude.com/pricing). Lines of code per module are our estimate of a minimal production version, based on building DoubleScale. Token ratios, rewrite counts and hours are assumptions shown in the calculator; real projects vary widely, so treat the results as orders of magnitude, not quotes.

Questions people ask

Can you vibe code a CRM?

You can vibe code a CRM prototype with contacts, a deals board and a dashboard in days. A CRM you can trust with customer data also needs permissions, reliable email, automations that never double-send, invoicing rules, backups and security review, which require someone who reads and tests the code.

How much does it cost to vibe code a CRM?

With our default six-module CRM, a prototype is about $59 of Claude Opus 5.5 tokens and around 28 hours of your time. Hardening it into something you can trust is about $564 of AI plus, by our estimate, more than 1,050 hours of developer work, hosting and yearly maintenance. Most of the cost is time, not tokens.

How many tokens does it take to build a CRM with AI?

For six core modules, about 0.7M output tokens for a prototype and about 6.7M to harden it with tests and bug fixing, plus many times more context tokens that the agent re-reads. Our calculator shows the numbers for your own choice of modules and model.

Is a vibe-coded CRM secure?

Not by default. Veracode found security flaws in 45% of AI-generated code samples in its 2025 tests, and missing access rules exposed data in about 170 apps built with Lovable. Have permissions, authentication and anything touching money reviewed by someone who reads code.

Is there a free, self-hosted CRM instead of building one?

Yes. DoubleScale is a free, GPL-licensed CRM for WordPress with unlimited contacts, email campaigns, automations, booking, invoices, a helpdesk and a client portal. Pro starts at $99 a year. EspoCRM is another open-source option you can self-host.

Can I use AI to customise an existing CRM?

Yes, and it is usually the best use of AI coding. Build your custom reports or integrations as a small add-on, and use the CRM’s API or MCP server so the AI works through the CRM’s own rules rather than editing its database.