Share article
Vibe Coding: A Prototype in Hours, Security Vulnerabilities for Years? What Sets Agentic Engineering Apart
Technical contribution
July 30, 2026
A Concise Guide for CTOs and Engineering Leads
- Vibe Coding is prompt-based software development: fast, exploratory, and ideal for prototypes and low-stakes applications.
- Agentic Engineering is a comprehensive engineering approach: it includes specifications, governance, and accountability.
- AI-powered software development is gaining ground. However, control—not speed—is what matters most.
- The key to productive systems lies in the process surrounding AI—and the question of who retains control.
- CTOs and engineering leads need a structured software development process, not just another tool.
- For more information on the strategic context, please visit our topic page on AI in software development.
The Appeal of Rapid Prototyping
AI currently offers the highest return on investment in software development. The entry point for many companies: vibe-coding tools like GitHub Copilot, Cursor, or Claude. Simply describe what you want to create in natural language, and a first working version is ready in minutes.
The effect is real: Prototypes are created in hours instead of weeks, even departments without coding expertise can bring ideas to life, and custom software development is once again economically viable—an aspect we’ve discussed in detail in our article on “Make or Buy.”
But this very advantage is also the challenge: It has never been easier to create technical debt or unmaintainable systems with inexperienced teams.
So the question isn't:"
" "Vibe Coding"—yes or no?
Instead:
When is Vibe Coding enough, and when is Agentic Engineering needed?
Vibe Coding vs. Agent-Based Engineering
Vibe Coding and Agentic Engineering are often used interchangeably in the market—as if they were both the same model of modern software engineering practice. In reality, however, they refer to fundamentally different things.
What is Vibe Coding?
Vibe Coding is a prompt-driven approach in which people describe what they want to create using natural language, and AI tools generate code based on that description. The code is often not read in its entirety, not systematically reviewed, and not validated against a formal specification.
This is intentional: The approach is optimized for speed and exploration, not for robustness.
What is Agentic Engineering?
Agentic engineering is not a tool mode, but rather a methodological approach. AI agents are embedded in a controlled software development process: with specifications as the source of truth, review milestones, automated tests, observability, governance, and clear accountability. Unlike pure agentic AI applications, in which agents act freely, here they remain embedded within an engineering process.
The goal is not speed at any cost, but rather transparent, secure, and scalable software delivery.
The Challenge for CTOs: Control Over Speed
While AI accelerates software development, it also shifts the bottleneck. The bottleneck shifts from writing the code to the quality of the foundation: clear requirements, sound architecture, and rigorous reviews.
Anyone who overlooks this connection will end up producing—even more quickly—exactly what they previously produced too slowly: code that no one can reliably maintain anymore. We’ve described in detail why a solid foundation is crucial for this in our article on the fundamentals of AI-powered software development.
Our task, therefore, is to implement quality assurance, testing, and maintainability in the right places. Testing has never been more important than it is now: on the one hand, to avoid regression bugs; on the other, to be able to make any meaningful statements at all about a system’s performance.
We've become so fast that we need to deliberately slow down in order to build a robust, scalable, and maintainable system.
Speed remains valuable—as a means, not as an end in itself. It becomes productive only when it is controlled.
The primary responsibility of engineering leads is to determine: Where is human approval required? Where can an agent act autonomously? Where are reviews mandatory? And where is monitoring sufficient?
Limitations in Production Operations
Anyone who deploys results developed using a prompt-based approach to production environments without testing them risks encountering issues that are invisible in the prototype but all the more costly during live operation.
A recent example: The Moltbook incident
In January 2026, Moltbook—a social network for AI agents—went viral. Its founder proudly announced that he hadn’t written a single line of code himself: the platform had been created entirely through Vibe Coding. Within a few days, it had 1.5 million registered agents.
Then security researchers from the company Wiz took a look under the hood and, within minutes, found a digital master key that was sitting out in the open in the website’s publicly viewable code. Because a key security feature had never been activated, this key granted access to the entire database—allowing users to read and modify data without having to log in. Freely accessible were 1.5 million access tokens, tens of thousands of email addresses, and private messages, some of which even contained other users’ AI access keys in plain text.
The cause wasn't some sophisticated hacking technique, but a single misconfigured setting—a mistake that any human review of the code would have caught. At Vibe Coding, that review simply never took place.
The Typical Blind Spots
Moltbook is not an isolated case. In client projects, we repeatedly see the same issues that are quickly overlooked when using a prompt-based approach:
The Typical Blind Spots
Moltbook is not an isolated case. In client projects, we repeatedly see the same issues that are quickly overlooked when using a prompt-based approach:
Safety – the classic
Lack of input validation, hard-coded secrets, insecure authentication implementations, SQL injections. Generated code appears to work, but is never checked for vulnerabilities.
Test Coverage and Quality Assurance
The test checks whether something works, not why or under what conditions. Edge cases and error paths remain untested.
Maintainability
No one really understands the code because no one wrote it intentionally. Refactoring becomes a shot in the dark, and technical debt accumulates unnoticed.
Audit Logs and Traceability
Neither in the code (no logging strategy) nor in the development process (no documented decisions, no reviews).
Scalability
The code works in the demo scenario with 10 records, but crashes under real-world load: N+1 queries, lack of caching, synchronous processing.
Compliance
GDPR-related aspects such as data minimization, data deletion policies, or data residency simply do not appear in the prompt and therefore do not appear in the code either.
Fault Tolerance and Disaster Recovery –
Happy-Path Programming
Error handling, retries, idempotence, and recovery scenarios are almost always missing.
Architecture and Modularity
Locally optimized individual solutions that lack a big-picture view, inconsistent patterns, duplication instead of abstraction.
Safety – the classic
Lack of input validation, hard-coded secrets, insecure authentication implementations, SQL injections. Generated code appears to work, but is never checked for vulnerabilities.
Test Coverage and Quality Assurance
The test checks whether something works, not why or under what conditions. Edge cases and error paths remain untested.
Maintainability
No one really understands the code because no one wrote it intentionally. Refactoring becomes a shot in the dark, and technical debt accumulates unnoticed.
Audit Logs and Traceability
Neither in the code (no logging strategy) nor in the development process (no documented decisions, no reviews).
Scalability
The code works in the demo scenario with 10 records, but crashes under real-world load: N+1 queries, lack of caching, synchronous processing.
Compliance
GDPR-related aspects such as data minimization, data deletion policies, or data residency simply do not appear in the prompt and therefore do not appear in the code either.
Fault Tolerance and Disaster Recovery –
Happy-Path Programming
Error handling, retries, idempotence, and recovery scenarios are almost always missing.
Architecture and Modularity
Locally optimized individual solutions that lack a big-picture view, inconsistent patterns, duplication instead of abstraction.
We have worked with companies that have deployed Vibe Coding software into production-level enterprise operations—resulting in unpredictable outcomes or significant security vulnerabilities. The actual error almost never occurs in the prompt itself. It occurs during the transition: when a prototype is transferred into the enterprise environment without being thoroughly tested.
Appropriate Areas of Application
Despite all the criticism, Vibe Coding has its rightful place. Companies should and must experiment with it. However, this experimentation must take place within a process that follows a sandbox, a maturity model, or an IT strategy, thereby ensuring that the resulting software is robust and scalable.
Vibe Coding is the right choice for these applications:
Rapid Prototyping
Prototypes can be developed very quickly. The only important thing is that the results are completely rebuilt later for enterprise use.
Exploratory Development and Spikes
Proof of Value, Proof of Concept—what matters here is gaining insights, not product maturity.
"Software-for-one" and low-stakes applications
Tools for a limited user base with low criticality. Important: A deliberate transition is needed as soon as a tool suddenly becomes relevant for more teams or operational processes.
Content, Marketing, and Presentations
Non-code artifacts that focus on results and iteration, not on enterprise standards.
The boundary is the same in all four cases: As soon as a result is incorporated into customer processes, real data, or production operations, the requirements change—and with them, the approach.
Vibe Coding or Agentic Engineering: Which Approach Is Best for Which Situation?
The decision between the approaches depends on the following question: “How critical, long-lasting, and relevant to regulations is the use case?”
| Criterion | Vibe Coding is a good fit if … | AgenticEngineering is necessary when … |
| Criticality | Errors that have minor consequences | Errors affecting customers, operations, security, or compliance |
| Service life | the result is short-lived or experimental | It must be maintainable and expandable in the long term |
| Data | No sensitive data is processed | personal, customer, financial, or regulated data is involved |
| Production Operations | Whether it's a demo, Spike, or Sandbox | it becomes part of a productive operation |
| Responsibility | a person responsible for training or demonstration purposes | Ownership, approvals, and incident responsibility are defined |
| Governance | There are hardly any formal requirements | Audit, compliance, security, or architectural requirements apply |
Rule of thumb for CTOs: Vibe Coding for exploration. Agentic Engineering for everything that is productive, long-lasting, data-relevant, security-relevant, or business-critical.
A Concrete Roadmap for Engineering Leads
Consciously allow Vibe Coding within a sandbox —don't ban it, but set limits. Give departments a defined space to experiment.
Define clear criteria for when a prototype may be put into production—establish criticality, data sensitivity, and lifespan as assessment criteria.
Establish reviews, tests, and governance early on—don't wait until the system is already in operation to implement them. Quality assurance belongs at the beginning of the process, not at the end.
Define the specification as the "source of truth "—document requirements, acceptance criteria, and constraints before writing any code.
Clearly define responsibilities —who approves, who reviews, and who is liable during operations. AI agents carry out tasks but are not held accountable.
Build agentic engineering as an organizational capability —not as the implementation of a tool. Help shape roles, processes, and competencies.
A Concrete Roadmap for Engineering Leads
Consciously allow Vibe Coding within a sandbox —don't ban it, but set limits. Give departments a defined space to experiment.
Define clear criteria for when a prototype may be put into production—establish criticality, data sensitivity, and lifespan as assessment criteria.
Establish reviews, tests, and governance early on—don't wait until the system is already in operation to implement them. Quality assurance belongs at the beginning of the process, not at the end.
Define the specification as the "source of truth "—document requirements, acceptance criteria, and constraints before writing any code.
Clearly define responsibilities —who approves, who reviews, and who is liable during operations. AI agents carry out tasks but are not held accountable.
Build agentic engineering as an organizational capability —not as the implementation of a tool. Help shape roles, processes, and competencies.
- Would you like to assess which approach is right for your engineering organization?
On our " AI in Software Development " topic page, you'll find an introduction to relevant workshop formats for engineering leads and CTOs.
How Agentic Engineering Works in Practice
Agentic Engineering is neither a tool nor a framework, but rather a way of working. It doesn't start with the prompt, but with the question of what the system is actually supposed to do and how this requirement can be verified.
- From Idea to Specification
It doesn’t start with code, but with a verifiable description of the desired outcome. Business logic, acceptance criteria, and constraints are captured as a living specification through dialogue between humans and AI. This specification is the source of truth: code is derived from it, not the other way around. - From Prompt to Controlled Workflow
AI agents do not operate freely, but rather follow atomic, testable tasks. Between the "Specify," "Plan," "Tasks," "Analyze," and "Implement" stages, humans verify the quality, suitability, and security of the generated artifacts at defined checkpoints. This ensures traceability and accountability, even as speed increases. - From Tool Usage to Engineering Capability
This means that Agentic Engineering is not a tool-related topic, but rather an organizational capability. It emerges from the interplay of processes, structure, tooling, and roles, and is based on the same principles we described in “The Fundamentals of AI-Powered Software Development.”
This is precisely where the “Agentic Shift” we’re currently experiencing comes into play: Companies can move from “Buy” (or “Rent”—thanks to SaaS, software is rarely purchased in the traditional sense these days) back to “Make.” However, this only works if the resulting software is robust and delivers sustainable, reliable business value. After all, software development only pays off if it generates business value.
FAQ on Vibe Coding and Agentic Engineering
What is Vibe Coding?
Vibe Coding is prompt-based development using tools such as GitHub Copilot, Cursor, or Claude, in which an idea is quickly turned into code, a prototype, or a simple application. It is particularly well-suited for exploration and early-stage idea validation, but is not automatically suitable for production-level enterprise systems.
What is the difference between Vibe Coding and Agentic Engineering?
Vibe Coding is optimized for speed—from prompt to result. Agentic Engineering is optimized for a controlled path from intention to a responsible system—with specifications, governance, reviews, and clear accountability.
When is Vibe Coding enough?
Vibe Coding is sufficient when it comes to prototypes, exploratory applications, or low-risk outcomes. As soon as maintainability, security, compliance, or scalability become factors, a more structured approach is needed.
Who is in charge at Agentic Engineering?
People are always ultimately responsible: Engineering Leads, architects, and developers define specifications, review points, governance, and approvals. AI agents carry out the work—no more, no less.
What exactly does “programming with AI” mean?
"Programming AI" or "AI programming" refers to approaches in which AI generates portions of code on its own. Vibe Coding is the most open-ended approach, while Agentic Engineering is the controlled variant that involves specifications, reviews, and accountability.
Conclusion: Develop in a controlled manner rather than just faster
Vibe Coding is a good starting point when speed and exploration are the top priorities. For productive, mission-critical software, however, Agentic Engineering is required: an approach that not only uses AI agents but also embeds them in a controlled manner within architecture, processes, reviews, and governance.
What matters most, therefore, is not so much which tool is used, but rather how control, accountability, and scalability are ensured.
Or to put it another way: Speed is just as important as knowing when to slow down at the right moments.
- Are you considering how your engineering organization can use AI in a productive and controlled manner?
About the author
As a partner at Dataciders, Christopher Klewes helps companies through data and AI consulting to set up software development and data platforms in a way that allows AI to scale productively. His focus is on integrating architecture, platforms, and engineering processes—from Microsoft Copilot Studio and Azure AI Services to end-to-end data and AI solutions. Dataciders is a Microsoft Solutions Partner with over 200 Microsoft certifications.
Share article
Further technical articles
[data_hub_count]
