Vibe Coding in 2026: Why It's No Longer Optional and What's Next for Programmers
Vibe coding has gone from experiment to the standard way of building software. We look at why staying out is no longer an option, whether it really produces less secure code, and why deep technical profiles will be needed more than ever.
- Software development
- Productivity
- Programming
- Artificial intelligence
In February 2025, Andrej Karpathy (OpenAI co-founder and former head of AI at Tesla) gave a name to a new way of programming: describe what you want to build in plain language and let AI write the code. He called it vibe coding. What looked like a weekend experiment back then has become, in little more than eighteen months, the everyday way software gets built.
In this article we tackle three questions clients and fellow developers ask us all the time: do you really have to jump on board? Does it produce worse code? And will we still need programmers?
Vibe coding is no longer optional: if you don't do it, you fall behind
The data leaves little room for doubt. Google Cloud's DORA 2025 report, based on nearly 5,000 professionals, puts AI use at work at 90%, and concludes that the question is no longer whether to adopt it, but how to get value from it. Stack Overflow's 2026 survey points the same way: two out of three developers use coding assistants or agents, and among daily AI users, almost a third spend four hours or more a day with these tools.
The practical consequence is simple: teams working with agents deliver in days what used to take weeks. Anyone still writing every line by hand is competing at a disadvantage on time and cost. This isn't a trend you can wait out. Even Karpathy has admitted he has never felt so far behind as a programmer. If it happens to him, it happens to everyone: it's time to catch up.
From “vibe coding” to agentic engineering
One year after coining the term, Karpathy proposed a more precise one: agentic engineering. His reasoning: today developers almost never write code directly; they orchestrate agents that do it and act as oversight. And he calls it engineering because there is craft and expertise behind it, something you can learn and get better at.
The distinction matters. “Go with the flow” vibe coding lowers the barrier to entry: anyone can build a prototype. Agentic engineering, on the other hand, keeps professional standards while moving much faster. Google's Addy Osmani sums it up: AI handles the implementation, while the human owns the architecture, quality and correctness. When this article talks about doing vibe coding well, this is what we mean.
Does it produce worse code? More vulnerable systems?
It's the most common objection, and it isn't baseless. Veracode tested more than 100 models across 80 coding tasks and nearly half of the samples (45%) failed OWASP Top 10 security tests. In April 2026, IOActive concluded that AI-generated code is not secure by default and should be treated as untrusted input. And CodeRabbit, analysing 470 pull requests, found a 2.74x higher vulnerability rate in AI code than in human code for equivalent tasks.
But the fine print matters. According to the Cloud Security Alliance, most documented incidents in 2025 and 2026 involved applications deployed without adequate security review. And a Stanford study back in 2023 identified the truly dangerous combination: developers using AI introduced more vulnerabilities while also feeling more confident their code was secure. The problem isn't the tool; it's using it without control.
With proper oversight, the opposite happens: more robust systems
Our experience at Xiltec is clear: well supervised, vibe coding doesn't produce more fragile systems, but stronger ones. Here's why:
Guardrails work. The same IOActive study measured that wrapper tools and security-focused instructions improve results by up to 25 percentage points.
Models are improving fast. A 2026 AppSec Santa analysis found confirmed vulnerabilities in 25.7% of samples, compared with around 40% in the 2021 Copilot study.
AI makes cheap what used to get cut. Tests, documentation, refactoring and security reviews were the first things to go when deadlines got tight. Now they cost far less, and the time saved writing code is reinvested in verifying it.
More layers of detection. Around 60% of vulnerabilities in AI code were caught by only one of the SAST tools analysed, so combining several scanners (and reviewer agents) multiplies coverage.
DORA sums it up in one word: amplifier. AI magnifies what's already there. In a team with good practices it multiplies speed and quality; in a disorganised one it multiplies chaos. In fact, the report finds that AI adoption improves delivery throughput but can hurt stability when the team lacks the capabilities to sustain it.
How to do vibe coding safely
Architecture and key decisions are always made by a person.
Spec before prompt: what is being built, under which constraints and with which acceptance criteria.
Project rules (conventions, allowed libraries, security patterns) live in a file the agent always reads.
Small changes, and every diff reviewed before it's accepted.
Automated tests are the contract: a task isn't done until they pass.
Continuous integration with several security scanners, plus extra review on authentication, permissions, cryptography and personal data.
AI output is treated like third-party code: audited, never taken on trust.
Will we still need programmers?
Yes, but the job is changing. Generating code is no longer the bottleneck; verifying it is. When an agent writes in minutes what used to take days, the value shifts to whoever can tell whether what it wrote is actually right.
Karpathy shared a telling example: in one of his projects, an agent tried to match users by their email address instead of a persistent ID. It works in the demo; it breaks in production the day someone changes their email. That kind of mistake isn't caught by someone who can't code. It's caught by someone with technical judgement.
That's why people with deep technical knowledge will remain essential to:
Spot when an agent isn't doing what it should, even if the code “works”.
Design the system's architecture and boundaries.
Think like an attacker: security demands an adversarial mindset that models don't have out of the box.
Debug systems nobody wrote line by line.
Make the important calls: according to Stack Overflow, only 6.6% of developers would trust AI with a major decision, and nearly half trust it only when they can verify the result.
The industry has started talking about “judgement debt”: flawed decisions that pile up when AI builds on its own, with no one who understands what's underneath. It's the modern version of technical debt, and only someone who can read the code can avoid it.
The challenge for junior developers
The barrier to start programming has never been lower, but the bar for real competence is higher. The risk is training a generation that knows how to ask for code but not how to read it. Our advice: use AI to go faster, but understand every line you accept, ask it to explain its decisions and, now and then, write the critical parts yourself.
Conclusion
Vibe coding doesn't replace programmers: it replaces the old way of programming. Those who don't adopt it will fall behind; those who adopt it without judgement will build fragile systems. The winning spot is in between: strong technical teams that direct agents, verify everything and use the time saved to build more robust software than ever before.
That's how we work at Xiltec. If you'd like to take your project forward with this approach, get in touch and let's talk.
Sources
DORA 2025 – State of AI-assisted Software Development (Google Cloud)
From Vibe Coding to Agentic Engineering – summary of Karpathy's talk
Agentic Engineering vs. Vibe Coding (Growth Acceleration Partners)
AI-Generated Code Is a Security Liability (CodeRabbit and Veracode data)
Images from Pexels: cover and cybersecurity photo by cottonbro studio; other photos by Lukas Blazek and Christina Morillo.
