Andrej Karpathy coined the term “vibe coding” in February 2025. By February 2026 exactly one year later he declared it obsolete.
Not because it doesn’t work. Because the industry had moved on to something better: agentic engineering, where developers orchestrate AI agents rather than just generating code by description.
But here’s the reality most CTOs are living in 2026: their teams are vibe coding in production, without governance, and the consequences are starting to compound.
- 40–62% of AI-generated code contains security flaws
- AI fails to protect against cross-site scripting 86% of the time
- March 2026 alone saw 35 new CVEs directly caused by AI-generated code – up from 6 in January
The speed gains are real. The risks are also real. And the gap between them is exactly where production systems fail.
This article gives you the honest version: what vibe coding gets right, where it breaks, and the governance framework that makes AI-assisted development safe to ship.
What Is Vibe Coding?
Vibe coding is a software development approach where a developer describes their intent in natural language to an AI model, accepts the generated code, and iterates through further natural language prompts — without deeply reviewing the implementation.
The term was coined by Andrej Karpathy in February 2025: “There’s a new kind of coding I call ‘vibe coding,’ where you fully give in to the vibes, embrace exponentials, and forget that the code even exists.”
Key characteristics of vibe coding:
- Developer describes what they want; AI generates the full implementation
- Developer interacts primarily through natural language, not code review
- Rapid iteration — changes made by describing intent, not editing syntax
- Minimal engagement with the underlying code logic
What vibe coding is not:
- AI autocomplete (which still requires the developer to write code)
- AI-assisted engineering (which uses AI tools within rigorous engineering discipline)
- Agentic engineering (which orchestrates AI agents with deliberate human oversight)
In plain terms: vibe coding is fast. It is not, by default, safe.
The State of Vibe Coding in 2026
Adoption has been extraordinary:
- 92% of US developers have adopted vibe coding in some form (Multiple surveys, 2026)
- 60% of new code will be AI-generated by end of 2026 (Gartner)
- Claude Code went from 17.7M to 29M daily installs in Q1 2026 alone
- Global AI-assisted coding market: $8.5B in 2026
The productivity numbers are compelling at the task level:
- 3–5× faster prototyping for isolated features
- 30–55% faster on scoped, well-defined tasks
- GitHub activity has exploded over the past 2 years. Developers using AI daily now merge 60% more pull requests. (GitHub, 2026)
But here’s where the story gets complicated:
Despite those individual productivity gains, organizations report only 10% improvement in overall delivery velocity. The speed at the task level doesn’t automatically translate to speed at the system level — because the bottleneck was never the code-writing. It was the architecture, the coordination, and the quality assurance.
And the security data is now impossible to ignore.
What Vibe Coding Actually Gets Right
Before the risks: the genuine case for vibe coding.
- Speed for exploration. Vibe coding compresses weeks of prototyping into days. For teams validating product ideas, building MVPs, or exploring technical approaches, this is genuinely transformative. Getting to “does this work?” in hours instead of weeks changes what’s possible.
- Accessibility for non-engineers. Founders, product managers, and domain experts can build functional tools and interfaces without deep engineering backgrounds. Internal tools, dashboards, and process automations that would never have been prioritized can now ship in a day.
- Accelerating routine implementation. For experienced engineers working on well-understood patterns — CRUD operations, API integrations, data formatting, utility functions — vibe coding compresses implementation time significantly while freeing cognitive bandwidth for harder problems.
- Breaking creative blocks. The ability to describe something and see it working — even imperfectly — changes how teams iterate. The generated code becomes a thinking tool, not just an output.
The 10–30% productivity improvement for appropriately governed AI coding is real. The companies seeing those gains built governance into the process. Those seeing chaos didn’t.
Where It Breaks in Production
The security numbers are not theoretical.
- 40–62% of AI-generated code contains security flaws
- AI fails to secure against cross-site scripting (XSS) 86% of the time
- AI-authored pull requests show 2.74× higher security vulnerabilities than human-written code
- 35 new CVEs were directly attributed to AI-generated code in March 2026 alone — up from 6 in January
AI package hallucination: AI suggests packages that don’t exist. Attackers register those package names to deliver malicious code when developers install them.
These are not edge cases. They are the default behavior of vibe coding without governance.
Real-world consequences already documented: authentication bypasses, code execution vulnerabilities, data breaches from insecure vibe-coded applications deployed to production.
The Slow Failure Nobody Talks About
The security incidents are visible and immediate. The deeper problem is invisible for months.
When code is generated through conversational prompts rather than deliberate design, architectural decisions are not documented. The system has no memory of why it was built a certain way. Each new prompt can introduce incompatibilities with prior undocumented choices.
As Retool describes it: “The resulting system behaves more like an evolving transcript than a deliberately engineered platform.”
Traditional technical debt builds linearly. Vibe coding technical debt compounds exponentially — because each change is made without the context of what came before it. At 6–12 months post-deployment, this becomes a maintainability crisis. The codebase is effectively a black box. Changes become unpredictable. The only option is a full rewrite.
BayTech Consulting frames it clearly: “The vibe coding hangover is real. Speed is breaking enterprise security. The companies experiencing it aren’t naive — they moved fast in a competitive market. But production systems require traceability, consistency, and predictable evolution.”
Speed is not free. When governance is absent, the bill arrives later — and it’s larger than the time saved.
GIANTY’s Take: The Governance Model That Makes It Work
The question isn’t whether vibe coding works. It’s whether your organization has the governance model that makes it safe to ship.
We’ve built and shipped production AI systems with Japanese-standard QA. Here’s our honest assessment.
Vibe coding is a drafting tool, not a delivery model.
The code generation is not the hard part. The hard parts are: architecture decisions, security review, edge case handling at volume, and the traceability that lets you maintain the system 18 months from now. None of those come from the prompt. All of them require deliberate engineering discipline applied to AI-generated output.
The handoff between AI output and production system is where everything lives.
When vibe-coded code moves toward production, there’s a moment of transition — from fast iteration to rigorous review. If that transition isn’t designed explicitly, it doesn’t happen. Teams keep iterating in vibe mode until something breaks in production.
We should define:
- Confidence thresholds — which components are low-risk enough to deploy with automated checks alone vs. which require senior engineer review
- Review contracts — exactly what each reviewer is responsible for evaluating (security, architecture, business logic, compliance)
- Traceability requirements — every AI-generated component documented with the context that produced it
The review standard is the same. The test coverage requirement is the same. The security scanning is the same. The only thing that changes is the speed at which draft code arrives for review. That speed is the benefit. The standard is non-negotiable.
Vibe coding gives you speed. Governance gives you a production system. The two are complementary tools — not alternatives — GIANTY AI Engineering Team
The 4 Gates Every Vibe-Coded Feature Must Pass
Organizations successfully using vibe coding in production have converged on four non-negotiable review gates. Getting all four in place allows AI-assisted development to accelerate output without increasing production incident rates.
Gate 1: Automated Security Scanning
All AI-generated code runs through automated security scanning before any production deployment — scanning specifically for the vulnerability classes where AI consistently fails: XSS, injection risks, hardcoded credentials, dependency vulnerabilities. This is infrastructure, not a step that can be skipped under deadline pressure.
Gate 2: Architecture Review
A senior engineer must confirm that the generated code fits the existing system design — that it follows established patterns, doesn’t introduce incompatible dependencies, and doesn’t create architectural drift. This is the check that prevents the “evolving transcript” failure mode.
Gate 3: Test Coverage Parity
AI-generated code must achieve the same test coverage requirements as human-written code. No exceptions. This gate exists specifically because vibe coding produces implementation without producing tests — the developer must close that gap before merge.
Gate 4: Traceability Documentation
Every AI-generated component is documented with the prompts and context that generated it, plus the architectural decisions made during review. This is the maintenance investment that makes the system sustainable 12 months from now.
Organizations implementing all four gates report 30–50% acceleration on applicable components with no increase in production incident rates.
When to Use Vibe Coding and When Not To
Not all code carries the same risk. The governance overhead should match the consequence of failure.
High-value, lower-risk use cases:
- Internal tools and dashboards (consequence of failure: low, recovery: fast)
- Isolated utility functions with clear test coverage
- Data formatting, transformation, and reporting logic
- Prototype and MVP validation before production investment
- CRUD operations on non-sensitive data
Proceed with full 4-gate governance:
- Customer-facing product features
- Authentication and authorization logic
- Payment processing or financial calculations
- Data storage and retrieval for sensitive information
- Any integration with external systems or APIs
Do not use vibe coding without senior architecture involvement:
- Core business logic with complex edge cases
- Security-sensitive components in regulated industries (healthcare, fintech)
- Distributed system architecture and orchestration layer design
- Anything where a production failure has legal, compliance, or safety consequences
Only 28% of healthcare organizations and 34% of financial services companies use vibe coding — not because the tools don’t work, but because the risk profile demands explicit governance, and most organizations in those sectors haven’t built it yet.
What’s Next: From Vibe Coding to Agentic Engineering
The trajectory is clear. Karpathy moved from writing 80% of his own code to delegating 80% to agents in a single year. The 2026 shift is from describing code to orchestrating agents — multi-step AI systems that plan, implement, test, and review within explicit governance frameworks.
The speed advantage compounds at each stage. The governance requirement compounds with it.
The organizations that win the next two years are not the ones who vibe code fastest. They’re the ones who build the governance infrastructure that makes AI-assisted development safe, sustainable, and scalable.
That infrastructure — the orchestration design, the review contracts, the quality gates — is the competitive advantage in 2026. Not the prompt.
FAQ: Vibe Coding in 2026
1. What is vibe coding?
Vibe coding is a software development approach where a developer describes their intent in natural language, accepts the AI-generated code, and iterates through further description — without deeply reviewing the implementation. The term was coined by Andrej Karpathy in February 2025.
2.Is vibe coding safe for production?
With explicit governance — yes, for appropriate components. Without governance — no. 40–62% of AI-generated code contains security flaws, and AI consistently fails on specific vulnerability classes (XSS, injection, authentication logic). Vibe-coded code requires the same security review, test coverage, and architectural validation as human-written code before production deployment.
3. What is the difference between vibe coding and agentic engineering?
Vibe coding describes intent and accepts generated output. Agentic engineering orchestrates AI agents — assigning tasks, defining guardrails, and validating outputs — within a deliberate governance framework. Karpathy moved from vibe coding to agentic engineering in 2025–2026. The shift is from AI as a code generator to AI as a managed collaborator in a controlled system.
4.How much faster is vibe coding?
At the task level: 3–5× faster for prototyping, 30–55% faster for scoped implementations. At the organizational level: approximately 10% faster overall delivery velocity, because the bottleneck is architecture and governance, not code-writing speed.
5. What are the biggest security risks in vibe-coded applications? The consistent failure patterns: cross-site scripting (XSS, 86% failure rate), hardcoded credentials, SQL injection exposure, weak authentication logic, improper input validation, and AI package hallucination (where AI suggests non-existent packages that attackers have registered maliciously).
6. What is the 4-gate governance framework for vibe coding? The four non-negotiable gates before vibe-coded code ships to production: (1) automated security scanning, (2) architecture review by a senior engineer, (3) test coverage parity with human-written code, and (4) traceability documentation of AI-generated components. Organizations implementing all four gates report 30–50% acceleration with no increase in production incidents.
7. When should companies NOT use vibe coding? For security-sensitive components (authentication, payments, data storage), complex business logic with significant edge cases, and any regulated industry application where a production failure carries legal or compliance consequences. Vibe coding in these contexts requires senior architecture involvement and all four governance gates — or should not be used.
Final Word
Vibe coding is not a fad. The productivity gains are real, the developer experience is genuinely better, and the tools will only improve.
But the governance gap is also real. And the production failures now surfacing are not theoretical — they are authentication bypasses, data breaches, and systems that compound their own entropy month by month until they can’t be maintained.
The honest answer to “should we use vibe coding?” is: yes, with governance; no, without it.
The speed is the draw. The governance is the infrastructure that makes the speed sustainable.
At GIANTY, we build the systems that run in production — not the pilots that impress in demos. That means the same Japanese-standard QA applies to AI-generated code as to everything we ship. The code generation is the easy part. Building the system that governs it is the work.
Ready to build an AI-assisted development workflow that actually runs in production? Let’s explore it together →
