Vibe engineering is just a sanitized term for replacing a threat model with a mood board and a hallucinating black box. If your AI agent is writing its own PRs without a human auditing every single byte, you haven't built a team, you've built a persistent threat actor with corporate benefits. I don't trust any workflow where the security audit consists of asking the bot if it feels like being malicious today.