Why I’m Afraid to Ship Code I Haven’t Read

I’ve been watching the rapid rise of "vibe coding" and agentic engineering over the last few months,...

I’ve been watching the rapid rise of "vibe coding" and agentic engineering over the last few months, and while the speed is undeniably impressive, I can’t shake a deep sense of unease.

The industry seems to be actively glorifying a new milestone: shipping code we haven't actually read. The prevailing defense is that if the AI writes the code, runs the unit tests, and the CI turns green, the human doesn't need to manually review the logic.

As someone who has spent years in the trenches of software engineering, this feels less like a revolution and more like a massive liability. I see two major blind spots we are collectively ignoring:

1. The Security Blind Spot Functional tests are designed to prove that a feature works; they are not designed to catch hidden backdoors. An agent can easily "fix" a bug by hallucinating an exec() command or introducing a subtle race condition. If no human is reading the actual logic, your CI will happily pass right as you ship a critical vulnerability.

2. The Regulatory Endgame This Wild West era of deploying unverified, agent-generated code to production is eventually going to result in a catastrophic, real-world security breach. When that happens, the government will inevitably step in with heavy-handed regulations. My fear is that the compliance costs will be so massive that only Big Tech giants will be able to afford them, essentially handing them a permanent monopoly over how software is built.

I know I might be biased. I admit that my internal defense mechanism leans heavily toward caution, and it’s entirely possible that my skepticism is making me miss the bigger picture. That’s exactly why I want to step outside my own echo chamber and hear from you.

Let's Compare Notes I am trying to build a map of what is actually happening on the ground, minus the hype. I’d love to hear your brutally honest experience with vibe, agentic, or chat coding in the comments...

• What does your actual day-to-day workflow look like?
• How are you handling code review and security validation?
• Are my concerns overblown, or are you seeing the same cracks in the foundation?

I would be incredibly grateful to hear your perspectives so we can figure out where this industry is actually heading.