Vibe Coding Gets You 80% There. The Last 20% Is Where Production Breaks.

AI agents can now build a working feature in a few hours. The first time you see it, it feels like magic.

Then you deploy it, and the magic gets complicated.

What goes wrong

The code usually runs. That's the problem. It looks finished, so nobody questions it. Here are the issues that come up again and again:

• Hardcoded secrets. API keys end up in config files or committed to the repo.
• Unknown dependencies. The agent installs packages you've never heard of, and sometimes ones nobody actively maintains.
• Missing edge cases. The happy path works. The one case your users actually hit doesn't.
• No tests. Nothing proves the code does what you think it does.

None of these are classic bugs. They're gaps in judgment, and that's where AI-generated code is weakest.

What to do differently

1. Review every dependency.
If you can't explain why a package is in your project, remove it.

2. Write tests first.
Let the agent code against your tests, not the other way around.

# Check what actually got installed before you ship
npm ls --depth=0
# or
pip list

3. Keep tasks small.
One agent, one clear job, one reviewable diff. Huge AI-generated pull requests don't get reviewed. They get approved.

4. Keep secrets out of prompts and code.
Use environment variables from day one.

# .env (never commit this)
API_KEY=your_key_here

const apiKey = process.env.API_KEY;

5. Read the diff like a code review.
Not like a magic trick.

The real shift

Whether we call it "vibe coding" or "agentic engineering," the skill is changing. It's less about typing code and more about directing, reviewing, and being accountable for what ships.

The AI writes it. You own it.

Your turn

Where do you draw the line with AI-written code? And what's the worst thing an AI agent has done to your codebase?

Drop it in the comments. I'd love to read your stories.