--- title: "Vibe-coded vs. engineered" description: "AI-only vs. AI + engineering: the real cost comparison. What happens when you ship vibe code to production." lastUpdated: "2026-06-23" canonical: "https://anvilstack.eu/en/compare/vibe-coded-vs-engineered" --- > Sitemap for agents: https://anvilstack.eu/llms.txt # Vibe-coded vs. engineered "Vibe coding" – a term coined by Andrej Karpathy (February 2025) – describes an approach in which developers let AI models generate code and take the result largely at face value, with little review. The payoff: a working prototype in hours instead of weeks. Professional engineering uses the same AI tools but combines them with architecture planning, code review, automated tests, and security hardening. The difference is invisible in the demo – but in production, under load, and after 12 months of further development, it becomes existential. ([Wikipedia: Vibe Coding – origin and definition](https://en.wikipedia.org/wiki/Vibe_coding)) > **Warning:** **This article is not an anti-AI manifesto.** AI-generated code is an enormous productivity lever. The problem is not the AI – it is dropping engineering discipline while using it. ## What the data shows The body of research on AI-generated code is growing denser – and the findings are nuanced: - **45%** – of AI-generated code contains security flaws (Veracode GenAI Code Security Report 2025) - **7.9%** – code churn rate in 2024 – nearly double the roughly 5.5% of 2020, since AI assistants became widespread (GitClear 2024) - **43%** – of developers trust the accuracy of AI code – around 30% actively distrust it; favorability fell from 77% (2023) to 72% (2024) (Stack Overflow Survey 2024) - **20–40%** – of the value of the technology estate is tied up in technical debt; 10–20% of the technology budget goes toward clearing it (McKinsey 2020) [Veracode: GenAI Code Security Report 2025](https://www.veracode.com/blog/genai-code-security-report/) [CodeRabbit: State of AI vs. Human Code Generation Report](https://www.coderabbit.ai/blog/state-of-ai-vs-human-code-generation-report) [GitClear: AI's Downward Pressure on Code Quality (2024)](https://www.gitclear.com/coding_on_copilot_data_shows_ais_downward_pressure_on_code_quality) [Stack Overflow Developer Survey 2024: AI Section](https://survey.stackoverflow.co/2024/ai) [McKinsey: Tech debt – Reclaiming tech equity](https://www.mckinsey.com/capabilities/mckinsey-digital/our-insights/tech-debt-reclaiming-tech-equity) ## Quality comparison in detail | Criterion | Vibe-coded | Engineered | | ------------------------- | ------------------------------------------------ | ------------------------------------------ | | Initial speed | Very high – MVP in hours/days | Slower – MVP in 2–6 weeks | | Security | No systematic review, known CWE patterns | OWASP Top 10 covered, dependency audit | | Test coverage | Usually 0% – no testing strategy | 60–80%+ unit/integration tests | | Scalability | Collapses under load (N+1, no caching) | Architecture built for growth | | Maintenance cost (year 1) | Low – as long as nothing goes wrong | Predictable – through monitoring and tests | | Maintenance cost (year 2) | Exploding – technical debt accumulates | Stable – through clean architecture | | Compliance (GDPR/NIS2) | Not addressed – has to be retrofitted | Built in from day one | | Team onboarding | Hard – no consistent style, no docs | Structured – conventions and documentation | | Dependencies | Uncontrolled – AI installs whatever is available | Curated – license and security audit | | Deployment | Manual or not configured at all | CI/CD pipeline, infrastructure as code | ## The real cost comparison: SaaS MVP over 24 months (illustrative AnvilStack in-house model) The upfront saving from vibe coding is real. But in most cases it flips into the opposite the moment the product goes to production and needs to grow. ### Scenario: B2B SaaS platform with auth, dashboard, API, PostgreSQL | Phase | Vibe-coded | Professionally engineered | | ----------------------------------- | ------------------------------------------------- | -------------------------------- | | **Initial development** | €0–2,000 (AI + your own time) | €36,000 (€6,000/month × 6) | | **Security assessment (month 3)** | €5,000–10,000 (critical findings) | €2,000–3,000 (minor findings) | | **Refactoring for scale (month 6)** | €15,000–30,000 (architecture rebuild) | €0 (designed to scale already) | | **GDPR/NIS2 retrofit** | €8,000–15,000 | €0 (built in from day one) | | **Maintenance over 24 months** | €20,000–40,000 (firefighting, bug fixes) | €10,000–15,000 (planned updates) | | **Team onboarding (2 developers)** | €5,000–8,000 (understanding + reworking the code) | €2,000–3,000 (clean structure) | | **Total cost over 24 months** | **€53,000–105,000** | **€34,000–61,000** | In-house model from AnvilStack based on typical project costs. The order of magnitude – a factor of roughly 1.5–2x over 24 months – is plausible, but the specific euro figures are an illustrative estimate, not collected data. For background on the cost of technical debt: according to McKinsey, technical debt accounts for roughly 20–40% of the value of the technology estate (plus a 10–20% cost premium per project). ([McKinsey: Tech debt – Reclaiming tech equity](https://www.mckinsey.com/capabilities/mckinsey-digital/our-insights/tech-debt-reclaiming-tech-equity)) > **Info:** **The irony:** vibe-coded projects cost almost nothing up front – and over 24 months, on average **1.5–2x more** than professionally engineered ones. The difference is the "technical-debt tax" that kicks in around month 3–6 and compounds from there. ## Why vibe-coded projects fail The most common problems do not surface immediately, but in production: **1. Security flaws.** AI models reproduce insecure patterns from their training data – SQL injection, missing input validation, hardcoded secrets, insecure deserialization. 45% of AI-generated code contains security flaws (Veracode). A separate analysis of 470 pull requests also found up to 2.74x more security issues in AI code than in code written entirely by humans (CodeRabbit). For an in-depth analysis with case studies, see our article [Vibe coding done right](https://anvilstack.eu/en/insights/vibe-coding-done-right.md). ([Veracode: GenAI Code Security Report 2025](https://www.veracode.com/blog/genai-code-security-report/)) ([CodeRabbit: State of AI vs. Human Code Generation Report](https://www.coderabbit.ai/blog/state-of-ai-vs-human-code-generation-report)) **2. Architecture collapse under load.** Without architecture planning, you get monolithic structures with N+1 queries, synchronous blocking, and no caching. That works fine with 10 users – and collapses at 1,000. **3. Uncontrolled dependencies.** AI coding tools increasingly pick packages automatically – no longer hand-selected by maintainers based on maintenance status or license. As a result, the dependency tree grows uncontrolled: the median JavaScript project today carries more than 680 transitive dependencies, including packages with known CVEs or incompatible licenses. ([Socket.dev: AI Has Taken Over Open Source](https://socket.dev/blog/ai-has-taken-over-open-source)) **4. Code churn as a warning sign.** The code churn rate – the share of code that is reworked or reverted within two weeks – has nearly doubled since AI assistants arrived: from roughly 5.5% (2020) to 7.9% (2024). In other words, AI-generated code is measurably rewritten more often and faster than hand-written code. That points to lower first-pass quality. ([GitClear: Coding on Copilot – Code Quality Impact](https://www.gitclear.com/coding_on_copilot_data_shows_ais_downward_pressure_on_code_quality)) ## When vibe coding is the right choice A fair comparison has to acknowledge: not every project needs professional engineering. **Vibe coding is perfectly sufficient for:** - Personal tools and automations - Internal prototypes for validating ideas - Hackathon projects and proofs of concept - One-off scripts for data cleanup or migration - Learning projects and experiments **Professional engineering is necessary for:** - Products handling customer data (GDPR-relevant) - SaaS platforms with paying users - Regulated industries (finance, healthcare, energy) - Software that has to scale (>100 users) - Investor due diligence and exit scenarios - Platforms subject to NIS2 or EU AI Act requirements – in which case [professional MVP engineering](https://anvilstack.eu/en/services/mvp-engineering.md) is the right approach ([EU AI Act: Regulatory Framework](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai)) ## The middle path: AI speed with engineering quality The dichotomy of "vibe coding vs. engineering" is a false dilemma. The most productive approach combines both: 1. **AI for speed:** initial code generation, boilerplate, tests, documentation 2. **Engineering for quality:** architecture review, security audit, performance testing, CI/CD 3. **Systematic validation:** every AI-generated component goes through the same review process as hand-written code This hybrid approach pairs AI speed in code generation with engineering quality in review, testing, and security – prototype speed with production-grade quality, without the technical debt of unreviewed vibe coding. McKinsey studies show that AI tools speed up routine tasks like documentation and code generation by 35–50%, without sacrificing quality, when developer and tool work together. ([McKinsey: Unleashing Developer Productivity with Generative AI](https://www.mckinsey.com/capabilities/tech-and-ai/our-insights/unleashing-developer-productivity-with-generative-ai)) > **Tip:** **The AnvilStack principle:** we use AI tools extensively – but every line of code goes through architecture review, automated tests, and security scans before it reaches production. The result: prototype speed with production-grade quality. ## The decision matrix Three questions determine whether vibe coding is enough: 1. **Do you process personal data?** If yes → engineering required (GDPR Art. 25: privacy by design) 2. **Do you have paying customers?** If yes → engineering required (availability, security, maintainability) 3. **Should the software live longer than 6 months?** If yes → engineering required (technical debt accumulates exponentially) ([Stripe: Developer Coefficient – the cost of poor code quality](https://stripe.com/files/reports/the-developer-coefficient.pdf)) If all three answers are "no," vibe coding is an efficient choice. Otherwise, professional engineering is not a cost decision but an investment decision. In the [Analysis](https://anvilstack.eu/en/services/prototype-audit.md), we evaluate your vibe-coded prototype for security flaws, architectural weaknesses, and scaling problems; the initial consultation is free. At €6,000 per month over 6 months (€36,000 total), we migrate and harden your platform – with a working app on Hetzner as the result. [Book a no-obligation intro call](https://anvilstack.eu/en/contact) ## Frequently asked questions ### What is the difference between vibe coding and professional engineering? Vibe coding takes AI-generated code largely at face value, with little review. Professional engineering uses the same AI tools but combines them with architecture planning, code review, automated tests, and security hardening. ### What does vibe coding cost in the long run? The upfront saving flips into the opposite: in an illustrative AnvilStack in-house model, a vibe-coded project costs €53,000–105,000 over 24 months vs. €34,000–61,000 for professional engineering – a factor of 1.5–2x. ### When is vibe coding good enough? For personal tools, internal prototypes, hackathon projects, one-off scripts, and learning projects. The moment customer data, paying users, or a lifespan beyond 6 months enters the picture, you need engineering. ### What security flaws does AI-generated code have? 45% of AI-generated code contains security flaws – SQL injection, missing input validation, hardcoded secrets, insecure deserialization (Veracode). A separate analysis of 470 pull requests found up to 2.74x more security issues in AI code than in code written entirely by humans (CodeRabbit). ### Can I salvage my vibe-coded prototype? In most cases, yes. The Analysis evaluates the architecture, security and compliance of your prototype and determines the shortest path to a production-ready platform; the initial consultation is free. ### How does AnvilStack combine AI with engineering? AI for speed in code generation, engineering for quality in review, testing, and security. This hybrid approach pairs prototype speed with production-grade quality, without the technical debt of unreviewed vibe coding. ## Sources - [Wikipedia: Vibe Coding – definition and origin (Andrej Karpathy, 2025)](https://en.wikipedia.org/wiki/Vibe_coding) - [Veracode: GenAI Code Security Report 2025 – 45% security flaws in AI code](https://www.veracode.com/blog/genai-code-security-report/) - [CodeRabbit: State of AI vs. Human Code Generation Report – 2.74x more security issues in AI code](https://www.coderabbit.ai/blog/state-of-ai-vs-human-code-generation-report) - [GitClear: Coding on Copilot – code churn rate from 5.5% (2020) to 7.9% (2024)](https://www.gitclear.com/coding_on_copilot_data_shows_ais_downward_pressure_on_code_quality) - [Stack Overflow Developer Survey 2024: AI Section](https://survey.stackoverflow.co/2024/ai) - [McKinsey: Tech debt – Reclaiming tech equity (technical debt = 20–40% of the technology estate)](https://www.mckinsey.com/capabilities/mckinsey-digital/our-insights/tech-debt-reclaiming-tech-equity) - [Stripe: The Developer Coefficient – $85B in annual costs from bad code](https://stripe.com/files/reports/the-developer-coefficient.pdf) - [McKinsey: Unleashing Developer Productivity with Generative AI](https://www.mckinsey.com/capabilities/tech-and-ai/our-insights/unleashing-developer-productivity-with-generative-ai) - [Socket.dev: AI Has Taken Over Open Source](https://socket.dev/blog/ai-has-taken-over-open-source) - [EU AI Act: Regulatory Framework for Artificial Intelligence](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai) - [NIST: Software Supply Chain Security Guidance (EO 14028, Section 4e)](https://csrc.nist.gov/pubs/other/2022/02/04/software-supply-chain-security-guidance-eo-14028-s/final) - [OWASP Top 10: Web Application Security Risks](https://owasp.org/www-project-top-ten/)