When Andrej Karpathy coined "vibe coding" in early 2025, the reaction split the developer community in two. One half said: "This is the future — stop writing boilerplate, just describe what you want." The other half said: "This is reckless — shipping code you don't understand is how you create security disasters."
Both camps were right. They were just describing different use cases.
A year later, "vibe engineering" has emerged as the term for the synthesis: all the productivity of AI-assisted development, with the professional discipline that production code demands. The tools are the same. The workflow is the same. What changes is the human layer — and crucially, how much of that layer you automate with testing.
The Definitions
Intent → Ship
Describe what you want in plain English. AI writes the code. You accept it, run it, and ship it. Minimal review. Minimal testing. Maximum speed.
Intent → Review → Test → Ship
Describe what you want in plain English. AI writes the code. You review it, understand it, test it, and then ship it. Same AI. Added discipline.
The word "vibe" is intentional in both. Both approaches work at the level of intent rather than implementation. You communicate what the software should do, not how it should do it. The AI handles the how. The difference is entirely in what you do after the AI responds.
"Vibe coding is the prototype. Vibe engineering is the product."
Side-by-Side Comparison
| Dimension | Vibe Coding | Vibe Engineering |
|---|---|---|
| Goal | Ship the fastest possible version | Ship fast and maintainably |
| Code review | None or minimal — trust the AI | Human reads and owns every line |
| Testing | Manual spot-check, if anything | Automated — vibe testing with Playwright |
| Security | Not audited unless problems emerge | Scanned on every PR |
| Architecture | AI decides — may not scale | Human-approved structure |
| Maintainability | Often brittle after a few iterations | Refactored and documented |
| Who it suits | Founders, hackers, prototypers | Professional teams, production codebases |
| Speed | Maximum (no gates) | Very fast (gates are largely automated) |
| Code ownership | "It works, I didn't write it" | "AI drafted it, I own it" |
The Workflow, Step by Step
Vibe Coding Workflow
"Build me a user authentication system with email/password login and a JWT token stored in a cookie."
Paste the generated code, run it, see if it works in the browser. If yes, move on.
"Now add Google OAuth." Accept the output. Test manually. Ship.
What vibe coding misses: The JWT above might store the token insecurely, have no CSRF protection, or expose user IDs in predictable patterns. Without review, none of this surfaces until it is a live vulnerability.
Vibe Engineering Workflow
Same prompt: "Build me a user authentication system with email/password login and a JWT token stored in a cookie."
Read every line. Check token expiry, httpOnly cookie flags, rate limiting, input sanitisation. Ask the AI to fix anything that falls short.
"Test the login flow: valid credentials redirect to /dashboard; wrong password shows an error; empty fields show validation messages." Claude + Playwright MCP generates the test suite in under 5 minutes.
Playwright tests run on every PR. Security scanner flags any issues. TypeScript catches type errors. Nothing merges that does not pass.
Same speed advantage as vibe coding — the generation step is still instant. The quality gates are automated, so they add minutes, not days.
Vibe Testing: The Bridge Between Both Worlds
The biggest objection to adding engineering discipline to vibe coding has always been: "Tests take too long to write. We'll add them later." "Later" never comes.
Vibe testing dissolves this objection completely. Instead of hand-writing Playwright tests — which can take 2–4 hours per feature — you describe what you want to verify in plain English and Claude AI generates the Playwright TypeScript in under 5 minutes.
This makes the testing step of vibe engineering as fast as the coding step of vibe coding. The entire workflow — generate, review, test, ship — can happen in a single focused session rather than across multiple sprint days.
How it works: The Playwright MCP Server connects Claude AI to a live browser session. You describe your test in plain English. Claude navigates your actual application, reads the real DOM, and writes test code using accurate selectors. See the full vibe testing guide for setup and examples.
When to Use Each Approach
Use vibe coding when:
- You are exploring an idea and do not yet know if it is worth building
- You are at a hackathon and shipping in 24 hours
- You are the only user (personal tools, internal scripts)
- The codebase is throwaway — you will rewrite it properly if the idea validates
- There is no customer data, payment data, or security-sensitive logic involved
Use vibe engineering when:
- Real users will depend on the code
- The codebase will be maintained beyond this sprint
- Other engineers need to read and extend the code
- There is any security-sensitive functionality (auth, payments, personal data)
- The business depends on uptime and reliability
- You need to demonstrate code quality to customers, auditors, or investors
The transition moment: Most teams start with vibe coding on a new project and transition to vibe engineering the moment they onboard their first paying customer. The productivity gain that made vibe coding attractive does not disappear — it is preserved in the generation step. What changes is that you stop accepting AI output without review.
The Real Risks of Pure Vibe Coding in Production
Vibe coding's philosophy — trust the AI, ship fast — creates four categories of production risk that vibe engineering addresses:
1. Security vulnerabilities
AI models generate code that works, not code that is secure. Without review, vibe-coded authentication systems often have hardcoded secrets, insufficiently hashed passwords, missing CSRF tokens, or open CORS policies. These do not fail tests (because there are no tests) and do not throw errors — they silently create attack surfaces.
2. No regression safety net
When you ship with no tests, every subsequent AI-assisted change is a regression risk. The AI rewrites a function, inadvertently breaking behaviour from three sprints ago, and you have no automated way to catch it. Vibe testing closes this gap: every feature gets tested as fast as it gets built.
3. Knowledge silos
Code you do not understand cannot be maintained by a team. When the original vibe coder leaves and no one reviewed the AI output, the codebase becomes a black box. Vibe engineering's review step ensures at least one human genuinely understands every significant piece of the system.
4. Architectural drift
AI models optimise for answering the immediate prompt, not for long-term system architecture. Vibe coding at scale produces codebases where the authentication layer uses three different patterns, database calls exist in six different layers, and no two features handle errors the same way. Vibe engineering's review step catches and corrects architectural inconsistencies before they compound.
A QA Engineer's Perspective
From a QA standpoint, vibe coding and vibe engineering represent two very different testing realities:
In vibe-coded projects, QA engineers are firefighters. They are brought in after the fact to test systems built without any quality planning. They find security issues, integration failures, and edge cases that should have been caught at development time. Retroactive testing is slow, expensive, and demoralising.
In vibe-engineered projects, QA engineers are multipliers. The AI handles the boilerplate; vibe testing handles the routine coverage; QA engineers focus their expertise on the complex scenarios that AI cannot fully reason about — security edge cases, compliance flows, accessibility, performance under load. Their time goes further because the foundation is already tested.
If you are a QA engineer evaluating how AI changes your role, vibe engineering is the answer. It does not replace QA — it elevates it.
Getting Started with Vibe Engineering
If you are currently vibe coding and want to transition to vibe engineering, the fastest path is adding the testing layer first. Here is why: once you have automated tests in place, every AI-generated change is safe to ship. The tests catch regressions. The feedback loop tightens. Code review becomes easier because you can verify behaviour without reading every line.
- Set up Playwright in your project (
npm init playwright@latest) - Configure the Playwright MCP Server so Claude can read your live application — see the setup guide
- Vibe-test your most critical user flow first — login, checkout, or whatever breaks users if it fails
- Add vibe tests alongside every new AI-generated feature going forward
- Then add the code review habit — once tests give you confidence, review becomes faster because you can verify intent without tracing every code path
Full course: The Playwright + Claude AI & MCP Server: AI QA Automation 2026 course covers the complete vibe engineering workflow for QA — from MCP Server setup to agentic testing to building a CI/CD pipeline that runs vibe-generated tests on every PR.
Frequently Asked Questions
What is vibe coding?
Vibe coding is a term coined by Andrej Karpathy in 2025 describing AI-first development where you describe software in natural language and let the AI write all the code with minimal human review. It prioritises speed and iteration over code quality, architecture, or testing. Best suited to rapid prototyping rather than production systems.
What is vibe engineering?
Vibe engineering is the professional evolution of vibe coding. It keeps the same AI-assisted generation workflow but adds the human layer that production code requires: code review, automated testing (vibe testing with Playwright), security scanning, and architectural oversight. The AI generates; the engineer reviews, tests, and owns.
What is the key difference between vibe coding and vibe engineering?
Ownership and quality gates. Vibe coding: "AI wrote it, it works, I shipped it." Vibe engineering: "AI drafted it, I reviewed it, tested it, and I own it." The difference is not the AI tools — it is what you do with the output.
Who should use vibe coding vs vibe engineering?
Vibe coding suits founders building MVPs, hackathon participants, and anyone exploring ideas quickly. Vibe engineering suits professional developers and production engineering teams where code is maintained long-term, handles customer data, or must meet security and compliance requirements.
How does vibe testing fit into vibe engineering?
Vibe testing is the testing layer of vibe engineering. You describe what you want to verify in plain English, and Claude AI generates Playwright TypeScript via MCP Server. It closes the quality loop: AI-generated features get automated test coverage in minutes, making the entire AI-assisted development workflow production-safe without the traditional testing bottleneck.
Is vibe coding bad for production?
The "minimal review, trust the AI" philosophy is risky for production systems. AI-generated code can contain security vulnerabilities, incorrect business logic, and no test coverage — issues that may not surface immediately but cause serious problems at scale. Vibe engineering solves this by restoring the human review and testing layer.
Can I combine vibe coding and vibe engineering?
Yes. Use vibe coding for rapid exploration to validate an idea. Once you decide to keep it, apply vibe engineering: review the code, add vibe-tested Playwright tests, check for security issues. The initial vibe coding sprint gets you 80% there; the vibe engineering pass makes it production-safe.
What tools do vibe engineers use?
Claude Code or Cursor for AI-assisted generation, Playwright + Claude AI MCP Server for vibe testing, GitHub Copilot for inline suggestions, TypeScript strict mode, security scanners (Snyk, Semgrep), and GitHub Actions for CI/CD. The toolchain is standard professional engineering — AI is used at every generation step rather than just for occasional code completion.
How do I transition from vibe coding to vibe engineering?
Add one quality gate at a time: (1) read every AI-generated line before shipping, (2) add vibe testing with Playwright + Claude MCP, (3) enable TypeScript strict mode and a linter, (4) run a security scan on every PR. These four steps transform vibe coding into vibe engineering without losing the AI-assisted speed advantage.
Asim Noaman
Senior QA Automation Engineer & AI Testing Specialist
With years of hands-on experience building test automation frameworks for production applications, Asim specializes in combining traditional QA methodologies with cutting-edge AI tools. He has helped teams adopt Playwright and AI-driven testing workflows to ship faster with fewer bugs.