The 80% Trap of Vibe Coding: The Last 20% from AI-Written Code to Production

AI agents can now build a working feature in a few hours. The first time you see it, it feels like magic. Then you deploy it, and the magic starts to get complicated.

When the code "looks done," the problems are just beginning

The code usually runs—and that's exactly the problem. It looks finished, so nobody questions it. Here are some recurring issues:

• Hardcoded secrets: API keys end up in config files or get committed to the repository.
• Unknown dependencies: The agent installs packages you're not familiar with, sometimes ones that nobody is actively maintaining.
• Missing edge cases: The happy path works, but the one use case users will actually hit doesn't.
• No tests: Nothing proves the code actually does what you expect it to do.

None of these are bugs in the classic sense. They're judgment gaps—and that's precisely where AI-generated code is weakest.

The term "vibe coding" was coined by Andrej Karpathy in early 2025, referring to a way of working where developers describe requirements to AI by intuition, adopt the generated code almost without reading it, and ship it directly. It emphasizes rapid iteration and flow, but assumes a dangerous premise: that code running means it's correct. In contrast, "agentic engineering" treats AI agents as executors that need to be managed—developers define task boundaries, verify outputs, and bear the consequences. The core difference between the two isn't the tools, but the accountability structure: the former outsources review to luck, while the latter keeps review in human hands. Understanding this distinction helps you assess which mode your team is currently in and what processes need to be filled in.

How to change your approach: five key actions

Faced with these gaps, developers need to shift from "letting AI write code" to "being accountable for the code AI writes." Here are five actionable recommendations:

1. Review every dependency

If you can't explain why a package is in the project, remove it. Dependency review is the first line of defense against supply chain risk and unknown behavior.

2. Write tests first

Have the agent write code against your tests, not the other way around. Test-first not only verifies behavior but also sets clear boundaries for AI output.

Check which packages are actually installed before releasing:

Supply chain risk refers to the security vulnerabilities, malicious code, or uncontrolled maintenance status that third-party packages can introduce to a project. When installing dependencies, AI agents tend to prioritize packages that "just work" rather than the most mainstream, actively maintained ones, which can let obscure or abandoned packages into the dependency tree. When reviewing dependencies, at minimum confirm the package's maintenance frequency, download count, recent commit activity, and known vulnerability advisories; remove any dependency whose purpose you can't explain. Running `npm audit` or `pip-audit` regularly can surface known vulnerabilities, but it can't replace human judgment about whether the package is actually needed.

Test-first has taken on new meaning in AI-assisted development: tests are no longer just a verification mechanism, but a specification that constrains AI behavior. When you first write the expected behavior as executable tests and then hand the tests to the agent, it has clear passing criteria, reducing deviations from free-form improvisation. At the same time, tests also define the scope of review—the diff only needs to be read against the tests, rather than guessing intent line by line. For edge cases, writing tests first forces developers to think through the paths users will actually hit in advance, rather than waiting for AI to implement only the happy path and then patching it up.
# Check what was actually installed
npm ls --depth=0
# or
pip list

3. Keep tasks small enough

One agent, one clear task, one reviewable diff. Massive AI-generated pull requests don't get genuinely reviewed—they just get approved.

4. Keep secrets out of prompts and code

Use environment variables from day one.

# .env (never commit this file)
API_KEY=your_key_here

const apiKey = process.env.API_KEY;

5. Read the diff like a code review

Not like a magic show.

The real shift: from writing code to accountability

Whether we call it "vibe coding" or "agentic engineering," the skills required are changing. It's no longer primarily about typing code, but about directing, reviewing, and being accountable for the code that ultimately ships.

AI writes the code, but the responsibility is yours.

This shift in responsibility means developers need to build new working habits: while AI accelerates output, review, testing, and dependency management must become non-negotiable steps. The 80% completion can take just a few hours, but the last 20%—the judgment work—is what determines whether the code can safely go to production.

Where do you draw the line?

Where do you draw the boundary for AI-written code? What's the worst thing an AI agent has done to your codebase? Share your stories in the comments.

One-line Summary

AI-written code running doesn't mean it's correct—developers must bear ultimate responsibility through review and testing.

Paragraph Summary

The article points out that AI agents can generate working features in a few hours, but "looking done" is exactly the problem: hardcoded secrets, unknown dependencies, missing edge cases, and no tests are recurring judgment gaps rather than traditional bugs. The author proposes five countermeasures: review every dependency, write tests before letting the agent write code, keep tasks small enough to genuinely review the diff, manage secrets with environment variables, and read diffs like code reviews. The core shift is the developer's role moving from writing code to directing, reviewing, and being accountable for delivered code. 80% completion takes only a few hours, but the last 20%—the judgment work—determines whether the code can safely reach production.