The 70% Problem

Andrej Karpathy coined "vibe coding" in February 2025. By February 2026, he'd abandoned the term for "agentic engineering." That trajectory tells the whole story.

Building an AI agent is trivially easy now. Claude Code hit $2.5B ARR in 8 months. 25% of YC startups have codebases that are 95% AI-generated. 95% of engineers use AI tools weekly. The barrier to entry didn't just lower — it evaporated.

The 70% is free. A working prototype from Claude Code in 2 hours. A chatbot that passes the first demo. A RAG pipeline stitched together from a YouTube tutorial. Every freelancer on Upwork can deliver this. Every founder with a laptop can build this.

The question is what happens next.

The last 30% is where everything breaks

AI-generated code has 2.74x more security vulnerabilities than human-written code. That's not anecdotal — it's from CodeRabbit's analysis of 470 pull requests. The same study found 8x more performance issues in AI-generated code.

170+ apps built on Lovable leaked user data through a single vulnerability (CVE-2025-48757, CVSS 8.26). Same pattern. Same three security holes. Zero code review between generation and deployment.

Amazon had 4 Sev-1 outages in one week from AI-generated code changes. Not experimental code. Production code that passed automated review and broke at scale.

Moltbook, a zero-code founder's AI-built app, leaked 1.5 million API keys in its first 3 days.

The pattern is consistent: the 70% works. The prototype passes the demo. The board sees fire emojis. And then production happens.

What the last 30% actually requires

The last 30% isn't more code. It's a different kind of engineering:

Security hardening. AI-generated code trusts inputs it shouldn't. It skips validation it doesn't know to add. It creates injection vectors that look clean on first read. The 2.74x vulnerability multiplier isn't because AI writes bad code — it's because AI writes plausible code that hasn't been adversarially tested.

Evaluation pipelines. Not "it looks right." Not "the client is happy." Quantified, baselined, monitored evaluation against real-world inputs. Every edge case documented. Every failure mode tracked. The prototype that passes 50 test cases will fail on case 51 in production — and nobody will notice until a user does.

Domain knowledge architecture. Prompts are not architecture. Structured expertise — medical classifications, legal cross-references, financial compliance rules — encoded into systems that agents can reason through. An agent without domain architecture is a chatbot with extra steps.

Failure mode design. Agents fail silently. They hallucinate with confidence. They make decisions that look correct and are subtly, dangerously wrong. Multi-agent validation chains, structured output schemas, fallback paths, and human escalation triggers. This is half the engineering.

The bifurcation

The market is splitting. On one side: anyone who can prompt an LLM is building agents. On the other: the production systems that actually run businesses require more expertise than ever.

Sidu Ponnappa put it cleanly: "If Claude can build it in 2 hours, it's not a product."

Kent Beck: "When anyone can build anything, knowing what's worth building becomes the skill."

The 70% is commoditized. The last 30% is where 90% of the expertise lives. The question isn't whether you can build an AI agent. The question is whether it survives production.

Where we come in

We don't compete with Claude Code. We're the engineering that happens after Claude Code gets you to 70%.

Security audits on AI-generated code. Evaluation pipelines that catch what demos miss. Domain architecture that turns prompts into production systems. Failure mode design that prevents silent catastrophes.

If you've built the 70% and need an expert for the last 30%, that's exactly what our AI Production Hardening service exists for. Start with Claude Code. Call us when the prototype needs to become a product.