From Vibe Coding to Agentic Engineering — How Programming Is Changing

Posted on: 5/12/2026 10:19:15 AM

1. What Is Vibe Coding?

In February 2025, Andrej Karpathy — OpenAI co-founder and former AI Director at Tesla — coined the term Vibe Coding to describe a new programming paradigm: developers describe requirements in natural language, and AI generates the entire source code. Instead of writing each line of code, you simply "feel the vibes" and let AI do the work.

The core idea: forget that code even exists. You talk to AI, describe what you want, accept the results if they work, and move on. No need to read and understand every line of generated code.

2. The Vibe Coding Landscape in 2026

Just over a year after the term was coined, vibe coding has transformed the entire software development industry:

• 92% of US developers have adopted vibe coding practices at various levels
• 60% of new code written in 2026 involves AI assistance
• The global AI coding market reached $8.5 billion
• Karpathy himself admits that 80% of his code is now AI-written

The most popular tools: GitHub Copilot, Cursor, Claude Code, Windsurf, and Cline. Each tool is racing to support AI coding agents — from simple auto-complete to executing entire complex workflows.

graph LR
    subgraph "2023-2024"
        A["Autocomplete
Code suggestions"]
    end
    subgraph "2025"
        B["Vibe Coding
Describe -> Code"]
    end
    subgraph "2026"
        C["Agentic Engineering
AI Agents execute autonomously"]
    end
    A -->|"Evolution"| B -->|"Evolution"| C
    style A fill:#f8f9fa,stroke:#e94560,color:#2c3e50
    style B fill:#2c3e50,stroke:#fff,color:#fff
    style C fill:#e94560,stroke:#fff,color:#fff

3. The Next Step: From Vibe Coding to Agentic Engineering

Karpathy himself recently declared that vibe coding is already outdated. His new preferred term is Agentic Engineering:

• "Agentic" — because the new default is that you're not directly writing code 99% of the time. You orchestrate AI agents that do the work and serve as oversight
• "Engineering" — because this is a real art and science requiring expertise, not just typing prompts and hoping for the best

4. The Agentic Engineering Workflow in Practice

In the agentic engineering model, developers don't write code directly but design and supervise a pipeline:

graph TD
    A["Developer writes Spec
(Requirements + Constraints)"] --> B["AI Agent analyzes
and plans"]
    B --> C["Agent writes code
+ unit tests"]
    C --> D["CI/CD runs automatically
Lint + Test + Security scan"]
    D -->|"Pass"| E["Human review
Logic + Architecture"]
    D -->|"Fail"| C
    E -->|"Approve"| F["Deploy"]
    E -->|"Request changes"| B
    style A fill:#f8f9fa,stroke:#e94560,color:#2c3e50
    style B fill:#2c3e50,stroke:#fff,color:#fff
    style C fill:#2c3e50,stroke:#fff,color:#fff
    style D fill:#ff9800,stroke:#fff,color:#fff
    style E fill:#e94560,stroke:#fff,color:#fff
    style F fill:#4CAF50,stroke:#fff,color:#fff

Key steps:

1. Write detailed specifications: Instead of writing code, developers write clear requirements including constraints, edge cases, and acceptance criteria
2. AI Agent analyzes and executes: The agent independently analyzes the codebase, plans the approach, writes code and tests
3. Automated validation: CI/CD pipeline runs linting, type checking, unit tests, and security scanning
4. Human review: Developers review business logic, architecture, and design decisions — not syntax

# Example Spec for Agentic Engineering

## Feature: User Authentication Refresh Token

### Requirements:
- Refresh token must expire after 30 days
- Each refresh token can only be used once (rotation)
- When reuse is detected -> revoke entire token family
- Rate limit: max 10 refresh requests/minute/user

### Constraints:
- Do not modify existing Users table schema
- Backward compatible with v2 API
- Store tokens in Redis with TTL

### Edge cases:
- Concurrent refresh requests from multiple devices
- Token rotation when user changes password
- Clock skew between service instances

5. Security Risks — The Dark Side You Can't Ignore

According to a December 2025 analysis, AI co-authored code contains 1.7 times more critical issues than fully human-written code. Specifically:

6 Major Risk Categories

6. Best Practices — Safe Vibe Coding for Production

6.1. The "AI as Junior Developer" Principle

The most successful teams treat AI as a talented junior developer that needs constant supervision. AI writes code fast but lacks understanding of business context, security implications, and long-term architectural decisions.

6.2. Multi-layered Validation

graph TD
    A["AI generates code"] --> B["Static Analysis
ESLint, SonarQube"]
    B --> C["Security Scan
Snyk, Semgrep"]
    C --> D["Unit + Integration Tests"]
    D --> E["Human Code Review
Logic + Architecture"]
    E --> F["Staging Deploy + QA"]
    F --> G["Production"]
    style A fill:#f8f9fa,stroke:#e94560,color:#2c3e50
    style B fill:#2c3e50,stroke:#fff,color:#fff
    style C fill:#ff9800,stroke:#fff,color:#fff
    style D fill:#2c3e50,stroke:#fff,color:#fff
    style E fill:#e94560,stroke:#fff,color:#fff
    style F fill:#2c3e50,stroke:#fff,color:#fff
    style G fill:#4CAF50,stroke:#fff,color:#fff

6.3. No-Go Zones for AI Code

Some areas should remain human-coded:

• Authentication & Authorization: Login logic, access control, token management
• Payment Processing: Financial transactions, billing logic
• Cryptography: Encryption, key management, signing
• Data Privacy: PII handling, GDPR compliance

6.4. Governance with Version-Controlled Instructions

# .cursor/rules or CLAUDE.md
# Instruction file for AI agents

security:
  - Never store secrets in code or config files
  - Always parameterize SQL queries
  - Use bcrypt for password hashing, minimum 12 rounds
  - All API endpoints require authentication by default

architecture:
  - Follow existing patterns in the codebase
  - No new dependencies without explicit approval
  - Max function length: 50 lines
  - All public methods must have unit tests

7. How the Developer Role Is Changing

The most important developer skill in 2026 is no longer writing code fast, but rather:

• Writing clear specs: Precisely describing requirements, constraints, and edge cases
• Reviewing and catching bugs: Reading code quickly, detecting logic and security flaws
• System thinking: Understanding overall architecture and component interactions
• Context engineering: Designing optimal context for AI to produce the best results

8. When NOT to Vibe Code?

Situations where manual coding is preferable:

• Complex algorithms with invariants that are hard to verify through tests
• Compliance-related code (HIPAA, PCI-DSS)
• Performance-critical code requiring deep optimization
• Legacy system integration with poor documentation
• Code handling financial transactions or medical data

9. What's Next?

The clearest trend: the boundary between developer and AI will continue to blur. But this doesn't mean developers become redundant — on the contrary, the role becomes more important at a higher level: system design, quality assurance, and architectural decision-making.

Agentic Engineering isn't the end of programming — it's a natural evolution, much like how high-level languages replaced Assembly without diminishing the value of programmers. The winners will be developers who know how to combine AI power with deep understanding of technical fundamentals.

References

• Vibe coding — Wikipedia
• Vibe Coding Is Passe — The New Stack
• Karpathy on the Evolution from Vibe Coding to Agentic Engineering — Frank's World
• Vibe Coding and Its Implications — Black Duck
• The Real Risk of Vibecoding — Trend Micro