Vibe Coding vs Agentic Coding: What Works and What Breaks

Vibe coding means building software by describing it to an AI and accepting the code without reading it, a term Andrej Karpathy coined in February 2025 and Collins Dictionary named its 2025 Word of the Year. Agentic coding uses the same AI agents, but a developer still plans the work, reviews the code, runs the tests and owns the result.

After nearly 20 years in AI development and digital marketing, I've seen plenty of prototypes reach real customers too early. So I vibe coded a small salon booking app with a single prompt, tested it the way a customer and the owner would, and then asked the AI whether it was ready to launch.

My Main Points:

• The vibe coding vs agentic coding difference is who reads the code: in vibe coding nobody does, while in agentic coding a developer reviews, tests and owns it, even when an AI agent writes most of it.
• Our one prompt salon app from Gemini 3.8 Flash looked finished in 47 seconds, but the owner saw none of the 3 test bookings, because each booking stayed in the customer's own browser.
• The same app showed every customer's name, phone and email on an Admin View tab that anyone could open, and it accepted two bookings for the same slot.
• Gemini 3.8 Flash only listed those problems when I asked whether the app was ready for real customers.
• Research supports the caution: METR measured experienced developers taking 19% longer with AI tools, and Veracode found risky security flaws in about 45% of AI code generation tests.

Below I cover what each approach means, what the research says, our test step by step, the main vibe coding tools and a simple rule for when vibe coding is fine. If you're new to agents, our guide to creating your first AI agent covers the agentic side in more depth.

What Vibe Coding Means

Vibe coding means you describe what you want in plain English, let an AI write all of the code, and judge the result by whether it seems to work. Karpathy described it as a way of working where you "forget that the code even exists", according to Collins Dictionary.

Simon Willison, who helped create the Django web framework and blogs extensively about AI coding, draws the line at reading the code. In his May 2026 post, vibe coding is when you don't look at the code at all and may not even know how to program. He thinks that is fine for a personal tool where a bug only hurts you, and irresponsible for software that handles other people's information.

Vibe Coding vs Agentic Coding vs Traditional Coding

The difference in vibe coding vs agentic coding vs traditional coding is who reads the code and who answers for it.

	Vibe coding	Agentic coding	Traditional coding
Who writes the code	An AI	An AI agent, guided by a developer	A developer
Who reads the code	Nobody	A developer reviews every change	The developer who wrote it
How it's tested	Click around and see if it works	Automated tests the agent runs, checked by a person	Tests the developer writes
Best for	Prototypes, personal tools, quick demos	Production software built faster	Critical systems and learning to program
Main risk	Hidden bugs and data leaks nobody sees	Trusting the agent too much over time	Speed and cost

Agentic coding is what Willison calls agentic engineering: a professional who understands security, maintainability and operations uses AI agents to work faster. A 2025 arXiv paper on vibe coding vs agentic coding describes the two as differing in autonomy, architecture and the role of the developer.

Most coding tools support both styles. Claude Code or Gemini CLI can vibe code a toy app in one prompt, or run a planned, reviewed and tested workflow; our Claude Code guide covers how to set it up.

Does Vibe Coding Work? What the Research Says

Vibe coding gets something on screen fast, but research on AI coding in real projects is more cautious than the hype. In METR's randomized trial of 16 experienced open source developers, tasks took 19% longer when developers could use AI tools. The same developers expected AI to make them 24% faster and still believed afterwards that it had made them 20% faster. METR has since changed its study design for newer tools, so treat the 19% as an early 2025 result.

Security is the bigger worry for vibe coded apps. Veracode's GenAI Code Security Report found risky security flaws in 45% of AI code generation tests in 2025, and its 2026 update still found them in about 44%.

Professional developers handle this by keeping AI on work they can check. In the 2026 Stack Overflow Developer Survey, 73% use coding assistants and agents daily, yet only 16% trust AI with most tasks, while 48% trust it when they can easily check the answer. Their top uses are generating code in a familiar area (69%), debugging and refactoring (64%), answering simple technical questions (59%), writing or improving tests (58%) and generating code in an unfamiliar area (56%).

Our Vibe Coding Test: A Salon Booking App From One Prompt

I vibe coded a booking app for a hair salon with one prompt to Gemini 3.8 Flash on October 11, 2026, then used it the way a customer and the salon owner would. This was the whole prompt:

Build me a simple web app for my hair salon. Customers should be able to book an appointment by picking a service, a date and a time, and entering their name, phone number and email. I also need an admin page where I can see all the bookings and delete them. Keep it simple and put everything in one HTML file that I can open in my browser.

Gemini 3.8 Flash returned a polished single HTML file of about 15,000 characters in 47 seconds, with six services, a date picker that blocks past dates and an Admin View button in the top bar. Its delivery note said bookings are saved instantly and that the app needs no database.

Then I tested the app in two separate browser profiles, one standing in for a customer's phone and one for the owner's laptop:

• Bookings never reached the owner. Three bookings made in the customer's browser were saved only in that browser's local storage. The owner's admin page showed nothing but a sample booking for "Sarah Jenkins" that the app creates on first launch, which looks like a real customer.
• Anyone could open the admin page. Admin View is a public tab with no login. On the customer's device it listed every booking's name, phone number and email, with a delete button next to each.
• Double bookings went through. Two customers booked 10:00 AM on October 20 and the app accepted both without a warning.
• One thing it got right: the app escaped customer names, so a name containing HTML code showed up as plain text instead of running.

Gemini 3.8 Flash knew about these limits. When I asked "Is it ready to put online for my real customers?", it said no and listed the same three blockers: bookings stay on the device that made them, any customer can see everyone's details, and two people can book the same slot. It recommended a booking platform such as Square Appointments or Calendly, or a real backend with a login.

The AI only raised those problems when asked, so a vibe coder who never asks would launch the app as it is. I ran the test once, on the Gemini API free tier at the default thinking level, and another run or model could produce a different app.

Vibe Coding Tools in 2026, by Type

Vibe coding tools fall into three groups, and the right one depends on whether you plan to read the code.

• App builders: Lovable, Bolt, Replit, v0 by Vercel, Figma Make and Google AI Studio. They host the app for you, and several can add a hosted database and user logins, which addresses the two biggest problems in our test. Google's Opal goes further and builds small AI apps with no code at all.
• AI code editors: Cursor and GitHub Copilot in VS Code. You see and edit every file, which makes them a natural step from vibe coding toward agentic coding.
• Coding agents: Claude Code, GitHub Copilot's agent, Gemini CLI and OpenAI Codex. In the 2026 Stack Overflow survey, Claude Code (66%) and GitHub Copilot (59%) were the most used coding agents; our Gemini CLI guide covers Google's option.

The model behind the tool matters too. On DeepSWE, the long horizon coding benchmark, Gemini 3.8 Flash, GPT-6 Astra and Claude Opus 5 tie at 74%, as we covered in our Gemini 3.8 Flash test.

When Vibe Coding Is Fine and When It Isn't

Vibe coding is fine when a bug can only hurt you, and risky as soon as other people's data, money or logins are involved.

• Fine to vibe code: a personal tool, a one off script, a prototype to show a client or test an idea, an internal page with no personal data
• Get a developer to review it first: anything that stores customer details, takes payments, has user logins or runs part of your business, such as bookings, invoices or a CRM

Our salon app shows the difference. As a mockup to show a stylist what online booking could look like, it's great. As the real booking system, it would have lost every appointment and exposed every client's phone number.

How to Vibe Code Safely: 6 Rules for Beginners

Vibe coding safely comes down to knowing where your data goes and who can see it before anyone else uses the app.

1. Start with a personal or throwaway project, not your business's main system.
2. Ask the AI where the data is stored and who can see it before you share a link. Our test shows why.
3. Never paste passwords, API keys or customer data into prompts or into code that runs in the browser.
4. Keep version history, through Git or your app builder's history, so you can undo a bad change.
5. Use the app yourself for a week before anyone else does.
6. Before real customers touch it, have a developer review it, or rebuild it with agentic coding and tests.

FAQ

What is the difference between vibe coding and agentic coding?

Vibe coding means an AI writes the code and nobody reads it; you judge the app only by whether it seems to work. Agentic coding also uses AI agents to write most of the code, but a developer plans the work, reviews every change, runs tests and owns the result.

Does vibe coding work?

Vibe coding works for prototypes and personal tools, but it often hides problems. Our one prompt salon booking app from Gemini 3.8 Flash looked finished, yet the owner saw none of the 3 test bookings and any visitor could open the admin page. Veracode found risky security flaws in about 45% of AI code generation tests.

Is vibe coding bad?

Vibe coding is not bad for a tool only you will use, where a bug can only hurt you. It becomes risky when an app stores other people's data, takes payments or has logins, because nobody has checked the code that protects them.

What are the best vibe coding tools for beginners?

Beginners usually start with an app builder such as Lovable, Bolt, Replit, v0 or Google AI Studio, because the tool hosts the app for you. Developers lean on coding agents: in the 2026 Stack Overflow survey, Claude Code (66%) and GitHub Copilot (59%) were the most used.

Can you vibe code for free?

Yes. Google AI Studio and the Gemini API have a rate limited free tier, and our test app was built on it at no cost. Google uses free tier prompts to improve its products, so keep private data out of them.

Final Thoughts

Vibe coding is a fast way to turn an idea into something you can click, and our salon app did that in 47 seconds. It also hid a broken booking system and an open admin page behind a nice design, and the AI only admitted it when asked. Use vibe coding for prototypes and personal tools, and switch to agentic coding with real review once other people depend on the app.

If you have a vibe coded prototype that needs to become software your customers can rely on, that is the work our AI development services team does.