DHH Just Drew The Line Between Vibe Coding And Your Agent
DHH split vibe coding from agentic engineering on Lex Fridman. The same wedge is coming for every operator running AI agents in 2026.
DHH went on Lex Fridman five days ago and did something the AI marketing world has spent 12 months tiptoeing around: he split "vibe coding" from "agentic engineering" with a scalpel[1]. If you're an operator running a real business and you missed the distinction, you're about to pay for it. Because the founder next door already vibed a dashboard, an agent, a CRM in a weekend — and 90 days later, they're rebuilding it from scratch.
The wedge matters. Here's why.
What DHH actually said
The whole framing sat around one moment in the interview. DHH — Ruby on Rails creator, CTO of 37signals, and a guy who spent 20 years chiseling code by hand — said the November 24, 2025 release of Claude Opus 4.5 was the dividing line for him[1]. Not because the model got smarter. Because the harness got smart enough that he could hand it the fuzzy problem and get back working code that looked like his own.
That's agentic engineering. And here's the part most people are missing:
"But I had to be in the driver's seat. I had to tell it what I wanted, and I had to be the reviewer, the auditor of what was coming out."[1]
Even at DHH's level — with 20 years of instinct about what a good system looks like — the model output goes through a builder who can read it and say yes, no, closer, not there. That's the job. That's what makes it engineering.
Vibe coding is what happens when you skip that step. You tell an agent what you want, you accept whatever it hands back, you ship it. It runs. The dashboard shows numbers. The invoice looks paid. The agent replies to a customer email. You go, "wow, this worked," and you move to the next thing.
The problem isn't that it doesn't work today. The problem is what it costs you 90 days from now.
The 90-day reckoning
Escape.tech scanned 5,600 vibe-coded apps running in production and found over 2,000 vulnerabilities, 400+ exposed secrets, and 175 instances of personal data sitting in the wrong place — including medical records and bank account numbers[2]. Their broader analysis of 1,400+ vibe-coded production applications puts 65% of them with security issues and 58% with at least one critical vulnerability[3].
If those numbers feel abstract, here's a concrete one: in January 2026, six CVEs — recorded common vulnerabilities — were directly attributed to AI-generated code. By March, that number was 35[4]. Six-x growth in eight weeks. That's not a curve, that's a cliff.
And the maintenance side is worse. GitClear analyzed four years of code changes and found refactoring line moves down 70%, long-term legacy maintenance down 74% vs 2022 levels, and code duplication climbing hard[5]. The stuff engineers used to do that made a codebase possible to keep alive — the boring editorial work — has cratered. What's replaced it is more code, faster, that nobody understands.
The cost hits your bill next. One engineering writeup pegged infrastructure inflation at up to 400% at production scale, and documented a startup that saw a $12,000/month database spike from a single AI-generated dashboard[6]. The dashboard "worked." It also queried the database 40x more than it needed to, because the vibe never included "and don't burn my budget."
Why this is an operator problem, not a developer problem
If you're running a $2M service business, a $5M DTC brand, or a $10M media company, you're probably not writing code yourself. So why does this matter?
Because the same wedge applies to the agents you're deploying.
A customer-service agent that replies to 60% of tickets is a vibe agent if nobody's watching what it says. It works — until it agrees to a refund it shouldn't, or leaks pricing you don't offer publicly, or gets prompt-injected into forwarding order data somewhere it shouldn't go.
A cold-outreach agent that finds leads and drafts emails is a vibe agent if nobody's reading the outputs against a policy. It sends — until it emails the wrong list, or writes something an SEC-adjacent client can't legally receive, or gets flagged as spam and burns your domain.
A finance-ops agent that reconciles transactions is a vibe agent if nobody's auditing the ledger. It ticks off invoices — until three months of misclassified expenses hit your books and your CPA has to redo the year.
The pattern is identical to DHH's code example. The agent looks like it's working. The output is confident. The founder feels productive. Then 90 days pass, the reckoning arrives, and the "savings" from replacing a human turn into 3x the cost of rebuilding whatever the agent chewed through.
What agentic engineering looks like for a $5M business
DHH is doing agentic engineering on Rails and Omarchy. You're doing it on a business. Same pattern, different domain.
One: the human stays in the driver's seat, on purpose. Not forever, not on every task, but on the outputs that matter. A hospitality operator running an AI booking agent should be reading a sample of confirmations every week. Not because the agent will fail every time — it won't. Because the one time it fails and you didn't catch it, that's the one that makes the local Yelp review and costs you six months of trust.
Two: the agent gets a job description, not a prompt. A prompt says "answer customer questions." A job description says "answer questions in this tone, refer to these policies, escalate on these five triggers, never quote a price outside this range, log every interaction to this table." The difference between an agent that saves you 20 hours a week and an agent that costs you $50K in cleanup is 40 lines of clear scope.
Three: the receipts get pulled. Every agent workflow needs an audit trail — inputs, outputs, tool calls, decisions — sitting in a place a human can eyeball on Monday morning. If your agent can't tell you what it did last week in one screen, it's a vibe agent. It'll work until it doesn't, and you won't know which day was the day.
Four: the cost meter is visible. The $12K database spike didn't come from a bad model. It came from nobody looking at the bill until the bill arrived. Every agent-driven system gets a per-run cost, a per-day cap, and an alert. The alert fires before the reckoning, not after.
The line, drawn plainly
Vibe coding — and vibe agenting — is what happens when the excitement of the output silences the discipline of the review. It works most days. It fails the days that matter. And the failure is compound: security debt, maintenance debt, cost debt, trust debt, all stacking behind a dashboard that keeps saying green.
Agentic engineering — the DHH version, translated to your business — is what happens when a builder stays in the loop just enough to keep the ship pointed the right way. Not writing every line. Not reading every output. But close enough that the wheels don't come off in a week you're not paying attention.
The founders who understand this in the next six months are going to look back at 2026 like people looked back at 2001 web dev — a decade of compounding advantage from doing the disciplined version while everyone else vibed the hype cycle.
The founders who don't are going to look back and see the receipt.
If you want an audit of the agents already running in your business — what they're doing, what they cost, where the reckoning is hiding — that's what I do. 30 minutes, no pitch. I'll tell you exactly which ones are vibe agents and what the fix would look like.
-
DHH: Future of Programming, AI, Agentic Engineering, Vibe Coding & Linux (Lex Fridman Podcast #501)↩
DHH's on-record framing of Opus 4.5 as the dividing line and 'reviewer/auditor' quote
-
Methodology: 2k+ Vulnerabilities in Vibe-Coded Apps↩
5,600 vibe-coded apps scanned; 2,000+ vulns, 400+ exposed secrets, 175 PII/medical instances
-
Vibe Coding Technical Debt Crisis: What Developers Need to Know↩
65% of vibe-coded production apps have security issues; 58% have a critical vuln (citing Escape.tech scan of 1,400+ apps)
-
Vibe Coding Technical Debt: 8,000 Startups Are Now Paying to Rebuild↩
6 CVEs attributed to AI-generated code in Jan 2026, growing to 35 by March
-
The Maintainability Gap: 2026 AI Code Quality Research↩
Refactoring line moves down 70%, legacy maintenance down 74% vs 2022
-
Vibe Coding's 90-Day Reckoning: The Technical Debt Nobody Warns You About↩
400% infra inflation at production scale; $12K/mo database spike case from AI-generated dashboard
Ready to build your own AI system?
Book a Free Audit Call →Keep Reading
Never Put An AI Agent In Front Of An Upset Customer
AI-handled support hits 4.10/5 CSAT vs 4.30 for humans — and the gap is entirely emotional tickets. Here's the four-gate escalation design that closes it.
You Picked The Wrong Agent Framework. Benchmarks Say So.
You picked the framework off a listicle instead of a benchmark. Here's how LangGraph, CrewAI, AutoGen actually stack up — and the picking rule I use.
Your AI Agent Can't Send That Email. Blame OAuth.
Google's Gmail MCP server has 10 tools. Not one of them can send an email. Here's the OAuth gap breaking most AI email agent builds this month — and the fix.