From Vibe Coding to Agentic Engineering — Karpathy Buries His Own Concept, Georgia Tech Counts 56 CVEs in 3 Months and Claude Code Tops the Chart

In January 2025, Andrej Karpathy coined the term vibe coding to describe a new relationship with development: you describe what you want, AI writes the code, you accept without reading. Fourteen months later, in February 2026, Karpathy himself buries his own concept. The new term: agentic engineering. The distinction is fundamental. It's no longer "accept the code without looking" — it's orchestrating autonomous AI agents that plan, write, test, and deploy code under structured human oversight. And the reason for this pivot comes from the data: Georgia Tech identified 56 CVEs directly caused by AI-generated code in Q1 2026, with Claude Code leading the chart at 27 vulnerabilities.

Karpathy Buries Vibe Coding

The February 2026 quote is unambiguous: "You are not writing the code directly 99% of the time… you are orchestrating agents who do and acting as oversight."

Karpathy explained the progression. In December 2025, he described a ratio of 80/20 between manual writing and delegation to agents. By February 2026, the ratio had flipped — and kept flipping: he now delegates nearly all code to agents.

The breaking point isn't the amount of code delegated. It's the structure of delegation. Vibe coding, as Karpathy originally defined it, was suitable for throwaway projects — prototypes that would never be maintained. But LLMs improved enough that this boundary dissolved. Developers are vibe coding production code. And that's where the problem begins.

Agentic engineering adds what was missing: upfront architecture, systematic review, human quality assurance. The developer no longer writes — they supervise. But they supervise actively, not passively. It's the difference between a manager who signs everything without reading and a CTO who reviews every PR.

92% Adoption, 45% Vulnerabilities

The adoption numbers are staggering. According to early 2026 surveys, 92% of US-based developers use some form of vibe coding in their workflows. This is no longer a trend — it's the standard.

The global vibe coding tools market is projected at $8.5 billion. Cursor, Bolt.new, Claude Code, Lovable — the tools got good enough that non-developers started shipping real products. And developers started shipping 10x faster.

But the trade-off is documented. Veracode tested over 100 LLMs on security-sensitive coding tasks: 45% of AI-generated code samples introduce OWASP Top 10 vulnerabilities. AI co-authored code contained 1.7x more major issues than human-written code. Security vulnerabilities appeared at 2.74x the rate of human code.

Georgia Tech: 56 CVEs in Q1 2026, Claude Code Leads

Georgia Tech's Vibe Security Radar — a project from the School of Cybersecurity and Privacy — scanned over 43,000 security advisories to track vulnerabilities specifically caused by AI-generated code.

The results published April 13 are stark.

Q1 2026: 56 confirmed CVEs directly attributable to AI code. The acceleration is exponential: 6 in January, 15 in February, 35 in March. March 2026 alone exceeds all of 2025.

And the breakdown by tool is revealing:

Claude Code dominates — but not necessarily for the reason you'd think. Georgia Tech researchers explain that Claude Code is the most widely used for autonomous production development, which mechanically increases the exposure surface. The more a tool is used for real deployed code, the more its flaws are detected. Copilot, Cursor, and others are more often used as assistants in pair-programming mode — the developer reviews more systematically.

The real estimate is far higher. Researchers estimate between 400 and 700 CVEs across the open-source ecosystem in Q1 2026 — 5 to 10x what they detect — because many AI-generated vulnerabilities don't leave detectable metadata signatures.

The Cloud Security Alliance confirms the trend in a parallel report.

Harvard and Bloomberg: Two Angles on the Same Phenomenon

Karen Brennan, professor at Harvard Graduate School of Education, taught a six-week course on vibe coding in late 2025. Her angle: vibe coding changes "the economics of experimentation" — you can build a thing to understand a thing, and you can do it quickly. That's the pedagogical angle. AI as a learning-by-building tool.

Bloomberg covers the FOMO angle: vibe coding is creating a new form of professional anxiety. If everyone can code with AI, what's the value of a developer? And if non-developers ship products with Cursor or Lovable, what happens to junior developers?

Fortune identifies the real bottleneck: trust. Vibe coding rewards momentum, not rigor. The result: production code that works, passes basic tests, but hasn't been deeply reviewed, threat-modeled, or validated for security.

The Systemic Problem

The central insight is this: vibe coding works too well. The tools are good enough to produce code that compiles, passes tests, looks correct. The problem isn't that the code doesn't work — it's that it works almost perfectly, with flaws invisible to the naked eye.

That's exactly why Karpathy pivoted to agentic engineering. Not because vibe coding is bad — because it's dangerous when applied without structure.

And Georgia Tech's 56 CVEs are just the visible part. The estimated 400 to 700 are in production codebases, deployed, used by real users. Security debt is accumulating at a speed the industry has never seen.

In summary:

• Andrej Karpathy buries his own concept of vibe coding (January 2025) in favor of agentic engineering (February 2026) — the developer shifts from "accept without reading" to "orchestrate and supervise"
• 92% of US developers have adopted vibe coding — market projected at $8.5 billion
• 45% of AI code contains OWASP Top 10 vulnerabilities — 2.74x more security flaws than human code
• Georgia Tech Vibe Security Radar: 56 CVEs in Q1 2026, including 27 for Claude Code alone — real estimate: 400 to 700 CVEs across the open-source ecosystem
• Acceleration is exponential: 6 CVEs in January, 15 in February, 35 in March — more than all of 2025

Karpathy invented vibe coding because LLMs were getting good enough to write code. He buried it because they got good enough to write dangerous code. The shift from vibe coding to agentic engineering isn't a marketing rebrand — it's the recognition that 45% vulnerability rates and 56 CVEs in one quarter demand structured human oversight, not blind acceptance. AI codes faster than humans. It also introduces flaws faster than humans can detect them. The question is no longer "should we use AI to code?" — it's "how do we supervise what's already everywhere?"

Sources: Georgia Tech — Bad Vibes, The New Stack — Karpathy, Fortune — trust bottleneck, Bloomberg — FOMO.