From Vibe Coding to Agentic Engineering: Karpathy's Software 3.0 Discipline

In February 2025, Andrej Karpathy named vibe coding in a throwaway tweet — "fully give in to the vibes, embrace exponentials, and forget that the code even exists." A year later, at Sequoia Ascent 2026, he renamed the serious version of the same practice: agentic engineering.

The shift isn't cosmetic. Vibe coding raised the floor — anyone could build something. Agentic engineering raises the ceiling — and demands a discipline that vibe coding deliberately abandons. This guide breaks down Karpathy's Software 3.0 framing, the maturity ladder underneath it, and how to figure out which rung your team actually belongs on.

📋 What You'll Need

• A working AI coding tool — Cursor, Claude Code, Copilot, Aider, or similar
• One real codebase to evaluate against (not a toy project — the discipline only matters when correctness does)
• Honest answers to: who reviews the diffs, who owns the bugs, who gets paged at 3am
• 15 minutes to self-assess against the maturity ladder in section 4

🧠 Software 1.0 → 2.0 → 3.0: The Quick Recap

Karpathy's framing in his June 2025 YC AI Startup School talk introduced three software paradigms that now coexist in modern systems.

In Software 3.0, the unit of programming shifts from a function to a paragraph. The context window is the program. The LLM is the interpreter. Your repo is no longer code alone — it's code, weights, prompts, tool definitions, and humans reviewing output.

🌀 What Vibe Coding Actually Is (and What It Isn't)

Vibe coding is the workflow where you describe what you want, an AI writes it, and you ship without reading the code carefully. It's powerful for prototypes, personal tools, throwaway scripts, and learning.

It collapses the moment that code touches real users, real data, or real money. Karpathy is blunt about why: "You can outsource your thinking, but you can't outsource your understanding."

Vibe coding's failure modes are predictable:

• Security vulnerabilities sneak in because nobody read the diff
• The codebase becomes "bloated, copy-pasted, awkwardly abstracted, brittle"
• Bug fixes break unrelated features because there's no mental model
• Onboarding a new engineer is impossible — nobody understands the code, including you

If you want the longer explainer of where vibe coding came from and where it actually shines, see Vibe Coding Explained.

🛠️ Agentic Engineering: Karpathy's Definition

At Sequoia Ascent 2026, Karpathy defined agentic engineering as:

Three words in that definition do all the work.

"Discipline" — it's a practice with rules, not a vibe. Specs, reviews, tests, evals.

"Fallible" — agents are spiky. Karpathy: "It can refactor a 100,000-line codebase or find zero-day vulnerabilities, yet tells me to walk to the car wash." Treat them as powerful interns with savant patches, not senior engineers.

"Preserving" — the quality bar doesn't drop because AI wrote the code. Karpathy: "You are not allowed to introduce vulnerabilities because of vibe coding. You are still responsible for your software, just as before."

Floor vs. Ceiling

The cleanest way to remember the distinction:

Karpathy's prediction: the agentic-engineering ceiling is far higher than the old "10x engineer" myth ever was. Practitioners who internalize the discipline will outperform by orders of magnitude — but only if they actually internalize it.

📈 The Agentic Engineering Maturity Ladder

The most useful operationalization of Karpathy's framing is Swarmia's five-level autonomy ladder. Use it to honestly assess where your team is — and where you should aim.

The counter-intuitive rule: higher isn't always better

A senior engineer running L1 autocomplete on a sensitive payments file is being responsible. A junior dev pointing an L4 swarm at production infrastructure is being reckless. Match the level to the task, not to your ambition.

Anthropic's own internal teams keep "80–100% active human oversight" at L2 for most work. Most professional teams should plateau at L2–L3, reach for L4 only on narrow recurring chores, and treat L5 as experimental.

🧱 The Six Practices That Define the Discipline

Karpathy and the broader 2026 agentic-engineering community converge on roughly the same playbook. None of it is glamorous; all of it is what separates the discipline from the vibe.

1. Spec-driven workflow

Detailed specifications become the source of truth that agents implement against. Not a one-line prompt — an artifact you'd be willing to hand to a contractor. See Spec-Driven Development with GitHub Spec Kit for the working pattern.

2. Context as the program

In Software 3.0 the context window is your program. Curating which files, docs, screenshots, and prior decisions the agent sees matters more than the prompt itself. See Context Engineering for AI Coding Agents for nine techniques.

3. Tests and CI as the control surface

Agentic engineering treats automated tests, linting, and CI as the safety net that makes agent output trustworthy. Vibe coding treats them as optional. This is the single biggest cultural divide between the two.

4. Mandatory diff review

Every agent-generated PR gets read by a human who could have written it themselves. Karpathy's framing: the agent is your intern, not your replacement. You sign off on the code that ships under your name.

5. Adversarial testing

Karpathy's Twitter-clone-for-agents example: build the system, then have agents simulate adversarial activity against it. If the agent wrote the auth, another agent should try to break it.

6. Permission and isolation boundaries

What the agent can read, write, run, and reach over the network is part of the architecture, not an afterthought. The whole topic deserves its own deep-dive — see AI Coding Agents and Security Risks.

🔄 What Stays Human (And Always Will)

Karpathy is precise about which parts of engineering you cannot delegate to an agent — even at L5:

• Aesthetics and taste — what "good" looks like for this product
• System-level tradeoffs — storage vs. compute, latency vs. cost, simplicity vs. flexibility
• Security boundaries — what data crosses which trust line
• Knowing when the model is out-of-distribution — when the agent is bullshitting confidently
• Choosing what to build — Karpathy: "I am becoming the bottleneck of even knowing what we are trying to build, why it is worth doing, and how to direct my agents."

The skills that matter in 2026 are the skills that were always load-bearing — they're just no longer hidden underneath the typing.

🚦 How to Move Up the Ladder Without Falling Off

A practical migration path for a team currently doing ad-hoc vibe coding on production code:

🩺 Troubleshooting the Transition

💰 The Cost Math (Roughly)

Across 2026 reporting, the agentic-engineering cost curve looks like this:

The Anthropic 2026 Agentic Coding Trends Report notes Claude Code adoption grew 6x in workplace usage in under 12 months — most of that growth is at L2–L3, not the science-fiction tier.

🚀 What's Next

• 🧭 Self-assess which level your team actually operates at — most teams overestimate by one rung
• 📝 Write one real spec this week and hand it to an L3 agent — observe the gap between intent and output
• 🧪 Audit your test coverage before promoting any agent above L2 — tests are the agentic safety net
• 🔐 Define permission boundaries for any agent that touches your repo, infra, or secrets
• 📚 Pair this with the discipline-adjacent reads below

Related on fundesk: Vibe Coding Explained · Context Engineering for AI Coding Agents · Spec-Driven Development with GitHub Spec Kit · AI Coding Agents and Security Risks