Vibe-coding vs. spec-driven AI: what a $45k incident decided
An AI coding agent was prompted to add optimistic UI updates and auto-retry on network latency. It generated the code in minutes. It passed superficial unit tests. One overworked engineer merged it after a single manual review. On Saturday evening, the checkout pipeline double-charged 342 enterprise users during a flash promotion.
The post-mortem finding: the agent had silently bypassed idempotency checks on the backend billing gateway. The total cost came to $45,000 in refunds, support overtime, and damaged trust.
That incident is the opening premise of a framework article by Shulha Yahya, Part 1 of a three-part series titled The Spec-Driven AI Engineer. It lays out a boardroom argument between seven stakeholders, and the analytical reframe that came out of it.
️ The Seven Positions in the Room
The emergency board meeting that followed the incident had a second trigger: a VC investor forwarded a demo video of a rival startup that had cloned the company’s core feature set in under 48 hours using v0 and Bolt. The investor’s note: “Code is no longer a moat. They built your six-month roadmap over the weekend.”
That framing put seven people with seven different incentives into direct conflict. Yahya names all of them without declaring any one wrong.
- VC investor: prompt-driven development is the only pace that preserves the moat now that code generation has zero marginal cost.
- Product manager (Alex): vibe-coding shipped three experimental landing pages and two user flows in a single week. Rigid specs kill that velocity.
- Head of marketing: half of what gets launched for campaigns is disposable by design. A thirty-day microsite does not need three days of specification work.
- Principal architect: LLMs lack spatial, temporal, and state-machine awareness. Prompt without precise contracts and the model makes silent assumptions about your database schema and concurrency model. The double-charge was predictable, not anomalous.
- CTO (Dave): the patch itself cost real money. The agent loop took five retries to land. Each failure dumped 200 lines of stack trace back into its own context and restarted from a colder state. That is not speed.
- ROI auditor: vibe-coding saved 15 engineering hours on the checkout UI update. The incident cost $45,000. Speed is a vanity metric if incident remediation eats your runway.
- CEO: twelve-month runway demands vibe-coding speed. A stalled enterprise deal demands a SOC2 answer. There is no choosing just one.
The Reframe: Disposable vs. Durable
The argument had been framed as fast vs. slow development. The Principal Architect shifted the axis. The relevant spectrum is not speed. It is Disposable vs. Durable Software: how long does this thing need to stay correct?
A thirty-day conference microsite is disposable. A multi-tenant billing engine is durable. Treating both with the same development process is where the hidden liability accumulates.
For durable software, the framework proposes a direct inversion: the specification is the single source of truth, not the code. Code becomes an impermanent, regeneratable artifact derived from the spec. If code deviates from the specification, the code is defective, regardless of whether it compiles or passes tests.
In a Spec-Driven Development (SDD) paradigm, we stop auditing code line-by-line. Human judgment concentrates on approving human-readable, machine-executable specifications — contracts, schemas, state transitions. AI orchestrators handle code generation; automated gates validate the generated code against the spec, not the other way around.
What Minimum HIL Actually Means
The framework introduces the term Minimum HIL (Minimum Human in the Loop). The argument is that vibe-coding does not actually reduce human attention. It hides where that attention has to go: either into constant vigilance over everything the agent writes, or into nothing at all and a bet that nothing breaks.
Spec-driven development, in this framing, is the approach that makes human attention small and deliberate rather than large and invisible. A human approves the spec. A human verifies the final PR. Automated gates do the rest.
The VC investor, hearing this, updated the original premise. If anyone can generate ten thousand lines of code in ten minutes, raw output is not a moat. But sustaining a complex system through years of continuous AI-driven iteration without architectural collapse, context degradation, or catastrophic regression is considerably harder to fake in a weekend than a UI.
“The moat isn’t who reaches the prototype first. It’s who can repeatedly ship, scale, and maintain complex systems at AI speed without collapsing under technical debt.”
Where the Framework Stops
The article is honest about what the meeting did not resolve. The CEO asked whether the executable readiness gate described in the discussion existed as something a person could open and read the next morning, or whether it was still an idea from that afternoon. The CTO admitted it did not exist yet.
The Head of Marketing raised the harder objection: give engineers a five-minute manual gate audit under a tight release deadline, and it becomes a rubber stamp on the first bad night. Nobody in the room fully answered her.
Part 2 of the series is described as addressing both open threads: what has to be inside that checklist, and how to build it without it quietly becoming three days of manual spec-writing. The series targets CTOs, architects, product managers, and engineering leaders.
When This Works
- Your team is already running AI coding agents on production systems with real financial or data integrity exposure.
- You have experienced a regression or incident that traced back to unconstrained AI generation rather than a human logic error.
- You want a framework for deciding which projects get full spec treatment versus which get fast vibe-coded iterations.
When It Does Not
- Your codebase is still at the prototype stage and nothing you are building yet has durable state, multi-tenant data, or billing logic.
- Your team has not yet adopted AI coding agents at all. The vibe-coding vs. spec-driven tradeoff is not a live decision yet.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
