From vibe coding to agentic engineering: Security for AI-assisted blockchain development

February 19, 2026

AI-assisted development on Algorand has crossed a threshold. Agents can now build and deploy contracts in a single conversation.

We helped make that possible. But “vibe coding” your way to MainNet without understanding what you're shipping is like running with scissors.

So, put those down for a moment and hear me out.

The spectrum

Addy Osmani draws a meaningful distinction between the concepts of “vibe coding” and “agentic engineering” that is worth considering.

With vibe coding, you prompt an AI, hit "accept all" without reading the code, and paste errors back until it works. With agentic engineering, you orchestrate AI agents while remaining the architect, reviewer, and decision-maker.

The difference is important. Vibe coding ships fast but accumulates risk. Agentic engineering ships fast and stays maintainable. For anything touching real funds, that's the only way to get 10x velocity without 100x liability.

The risk is real

Web2 land is being flooded by vulnerable vibe-coded apps at a Cambrian scale, - an exposed admin route here, a database credential leak there. The cautionary tales are piling up.

Web2 breaches are serious, but there's usually a path to mitigate them: Identity theft protection, disputing fraudulent accounts, and clawing back funds through legal channels.

Smart contracts don't offer that luxury. A severe vulnerability drains funds immediately and irreversibly. No patch, no rollback, no refund.

So what do we do about it? We could try to limit the adoption of AI tooling and preserve the steep learning curve that's always gated blockchain development. But taking the scissors away works for toddlers, not developers and entrepreneurs.

Instead, we're going to teach you how to use them.

Principles for high-stakes development

For MainNet dApps, you need to firmly position yourself on the agentic engineering end of the spectrum.

There are plenty of generic vibe coding guides out there with solid advice. Our principles below focus on what moves the needle for Algorand development specifically:

Plan before executing. Use your agent’s Plan Mode to design your contract's architecture before writing code. The agent will explore the codebase, research Algorand patterns, and produce a spec: state schema, method signatures, access control, and invariants. You review this design, catch issues before a single line is written, and approve. Now the implementation has guardrails. AI fills in the code; you own the architecture.
Understand what you ship. If you can't explain why the generated code is correct, don't deploy it to mainnet. Testnet is OK. AI will confidently store user balances in LocalState – the obvious pattern for per-user data. What it won't tell you: users can clear local state anytime, and ClearState succeeds even if your program rejects it. Critical accounting, gone. An agent using the right skill would know to use BoxMap for data you can't afford to lose, which brings us to the next principle.
Use structured prompts and skills. Agent skills are curated instructions that guide AI toward established patterns. Instead of prompting "create my contract" and hoping for the best, use an agent skill that encodes current best practices. The difference is dramatic. Skills eliminate deprecated APIs, outdated patterns, and other hallucinations that plague LLM-generated Algorand code.
Keep keys out of reach. There's an argument to be made that it's mathematically impossible for an LLM to keep a secret. So don't give it one. Your agent should never see your private keys, not in environment variables, not in config files, not anywhere it can access. VibeKit uses OS-level keyrings to keep signing completely separate. AI requests transactions; a secure wallet provider signs them.
Test like an attacker. Coding agents miss subtle attack vectors constantly. Use algokit task analyze to catch the obvious ones, and make liberal use of simulate calls and integration tests to catch the subtle ones. Test malformed inputs, unexpected OnComplete actions, access control violations, and other edge cases. AI writes tests for the code it wrote. You write tests for the code an attacker would write.

Flip the script: AI for security testing

Instead of just worrying about AI introducing vulnerabilities, you should also use AI to find them. When approached correctly, AI becomes a force multiplier for security testing.

VibeKit includes a simulate_transactions tool that lets your agent craft attack transactions and test them without broadcasting. They run in a sandbox, reporting success/failure with state changes and errors. A community member recently demonstrated this by having their agent simulate unauthorized admin access, double settlement, fee evasion, and more. Algorand's protocol already mitigates entire classes of blockchain attacks – no reentrancy, for example – but AVM-specific vectors remain. Simulations are free. Let your agent go wild.

This space is rapidly evolving. Agent skills for security audits and static analysis are in development. Tools like Almanax bring additional vulnerability management tools. There's more to build, and AI makes that work more urgent.

The bottom line

"Vibe code responsibly" means you're doing agentic engineering. AI-assisted development does help you ship faster, but it needs to be paired with discipline and expertise.

Here's the thing, though: developers who already understand Algorand's security model get the most from AI tooling. But if you're still building that expertise, AI can accelerate your learning—if you treat every generated contract as a teaching moment. Ask it to explain the code. Ask why it chose BoxMap over LocalState. Ask what happens if someone calls this method with a rekeyed account. The same tools that let you build faster can help you learn faster, too.

Just remember what you're responsible for when it goes to MainNet.

Learn more about vibe coding on Algorand

Try Vibekit today.

VibeKit: The agentic stack powering vibe coding on Algorand: Read the post.

Algorand Agent Skills: Smarter AI for Algorand Development: Read the post.