Vibe coding vs agentic coding: 93 PRs, measured

What is the difference between vibe coding and agentic coding?

Vibe coding is building software with an AI model without reviewing the code it writes. Agentic coding has AI agents plan, write, test and fix code while a person sets the goal and stays responsible for what ships. Both can use the same models and tools. What separates them is whether anything, a test or a person, checks the code before customers see it.

Andrej Karpathy named vibe coding in an X post on February 2, 2025: “There’s a new kind of coding I call “vibe coding”, where you fully give in to the vibes … and forget that the code even exists.” He added, “I “Accept All” always, I don’t read the diffs anymore,” and called it “not too bad for throwaway weekend projects.”

A year later he picked a name for the careful version. In a post on February 4, 2026, he called “agentic engineering” his current favorite: “‘agentic’ because the new default is that you are not writing the code directly 99% of the time, you are orchestrating agents who do and acting as oversight.” Agentic coding is a related, older term. A May 2025 arXiv paper defined it as agents “capable of planning, executing, testing, and iterating tasks with minimal human intervention.”

Is vibe coding the same as AI-assisted coding?

No, although the term now gets used for both. Simon Willison drew the line in March 2025: “When I talk about vibe coding I mean building software with an LLM without reviewing the code it writes.” Collins Dictionary, which made vibe coding its Word of the Year for 2025, uses the wider sense: “the use of artificial intelligence prompted by natural language to assist with the writing of computer code.”

In practice the two differ on three questions. Who reads the code? In vibe coding, nobody; in agentic coding, the agent’s tests and then a person. What proves it works? In vibe coding, the app seems to run; in agentic coding, checks written in advance fail when something breaks. Who is it for? The transcript Karpathy published of an April 2026 talk splits it this way: “Vibe coding is about raising the floor for everyone in terms of what they can do in software.” And: “Agentic engineering is about preserving the quality bar of professional software.”

The tool doesn’t decide which one you are doing. Anthropic describes Claude Code as “an agentic coding tool that reads your codebase, edits files, runs commands, and integrates with your development tools.” The same tool can throw together a weekend app or work inside a test suite.

What does agentic coding look like on a real business site?

We measured it on Alliance Chemical’s Shopify storefront, which PHASEKIND built and maintains. Disclosure: Andre Taki, a PHASEKIND founder, is also Alliance Chemical’s Chief Commercial Officer. From September 18 to October 4, 2026, 93 pull requests were opened on the storefront’s repository. Claude Code opened 90 of them from inside a working session. 89 are merged. What the repository records is the automated side of the oversight, so that is what we measured.

It added up. The 93 pull requests changed 162,285 lines. The median one changed 177 lines, and the largest, at 28,410 lines, added redesigned templates for the industries pages. October 3 alone had 42. Figure 1 shows each one as a tile; step through it to see how big each change was and what the checks said.

What did the automated checks catch?

Thirteen of 267 check runs failed, on 5 of the 93 pull requests. The repository has three gates in GitHub Actions: a theme hygiene guard, search-quality tests and Playwright end-to-end tests. Each runs only when a pull request touches files it watches, so 82 pull requests triggered at least one gate and 11 triggered none.

Two were fixed before merge: one real catch and one test that needed updating. On October 3 the theme guard flagged a snippet left behind after a popup was removed from the homepage; the next commit deleted it, and the guard passed 90 seconds later. On September 30 a performance change altered how the product page writes the variant into its URL, and an end-to-end test stopped seeing it. The page was doing what the change intended, so the next commit, 12 minutes later, updated the test’s recorder.

On two more, an end-to-end run failed, and the fault was in the test setup: the preview theme the tests run against didn’t have the new quote page. A separate pull request copied the quote template and its 14 dependencies onto the preview theme. The fifth is a concept product page marked “DO NOT MERGE.”

What gets past the checks?

Anything nobody wrote a check for. Each gate runs only when a pull request touches files it watches, and 11 of the 93 touched none, such as stylesheet fixes, documentation and CI settings. No check looked at those changes at all. And a check tests only what it was written to test, so a change can pass every gate and still break something no gate examines.

The theme guard itself grew this way. It was written in July 2026 and has run as a CI gate since August, and most of its rules describe a failure that had already happened: dead snippets, or “dead code creeping back in”; GA4 commerce events sent twice, a “duplicate-counting regression”; and Liquid comments that start with a tag name, so “theme upload fails with a “tag was never closed” error pointing at the wrong line.” The habit that matters is turning each escape into a new check.

Unreviewed AI code fails in ways that are easy to predict. Veracode tested more than 100 models on 80 coding tasks in 2025 and reported that “while AI produces functional code, it introduces security vulnerabilities in 45 percent of cases.” A page that loads can still be unsafe to ship.

When is vibe coding good enough for a business?

When the result can be thrown away. Karpathy’s own scope was “throwaway weekend projects,” and a prototype that nobody pays through or logs into fits it. On the Alliance storefront, early concepts sit on an unpublished development theme behind a pull request marked “DO NOT MERGE,” where a broken build costs nothing.

Anything that takes payments, stores customer data or shows up in search needs the agentic version: checks that run on every pull request, a person who reads the change, and a new check each time something slips through. As the transcript of Karpathy’s April talk puts it: “You are still responsible for your software, just as before.”