|
|
|
Your Baker Now Writes Software
The last issue described a path many businesses are on with AI: first individuals and teams start prompting, next AI gets connected to company data, then a workflow is defined and handed to an agent. And in that issue, one number stood out to me: 32% of McKinsey's survey respondents skipped buying at least one software product because they built it in-house with AI coding tools.
In some cases, there was a development team behind the build. In other cases, non-programmers were using vibe coding tools: describing the requirements in plain English and letting AI write the software.
And while vibe coding produces working software quickly, research suggests that much of what's built is insecure and not production-ready. This issue talks about both: how to create software rapidly and effectively, and how to see the line between experimentation and a risk to your customers and your reputation.
|
|
Emergent is a vibe coding platform. According to SoftBank’s Vision Fund, an Emergent investor, nearly 80% of its 200,000-plus paying users have no coding experience. One, a Toronto meal-prep owner, built a customer portal, delivery routing, and a full CRM, and he estimates saving $2,500 in monthly software fees.
In another example, a bakery owner in the Philippines built his own website and online ordering system. He contacted customer support because he was having trouble loading some of his inventory. When instructed to roll back his code, the baker admitted that he wasn't entirely sure what programming was.
Key Insight: The person closest to the problem can now build software for it. But the story needs to include security and maintenance, especially once customer data is involved.
|
Advice from three people who have vibe coded dozens of apps. Describe the problem, not the app, so the AI can suggest options. Have it interview you, one question at a time, before it builds. Start in a sandbox, a test space with no real-world consequences. Bring a sketch or screenshot. And be clear about what "done" looks like.
My Take: Start with something that can't hurt anyone if it breaks. A page for your next webinar is low risk. A form that collects customer data is where you pause and have someone check the code.
Read the Advice →
Researchers ran a test that looks like everyday vibe coding. They took 150 security flaws that had shipped in real projects, removed the code, and asked six top AI models to rebuild them. The instructions described the feature, not the security. The code usually worked. But the best model produced code that was both and secure on only 25% of the tasks.
Why It Matters: The models seldom enforced rules nobody wrote down like what's private or which files can be read, etc. Those are business decisions, not code. Detail them in your request and confirm the app follows them.
Read the Research Paper →
|
Quick Hits
|
.Foundations
Vibe Coding, Explained
A solid, plain-English primer on the tools people use to vibe code an app. The loop: describe, generate, test, refine, repeat. And as a final step before launch, have someone with software expertise review the code for security and scalability.
|
|
.Video
The Vibe Coded Bug That Ran Just Fine
Andrej Karpathy says vibe coding raises the floor so everyone can build software. But people still need to own the plan, the judgment, and the oversight. As an example, in one of Karpathy's apps people sign in with Google and pay with Stripe. His agent linked payments to users by email, but if you use different emails for each platform, your credits never show up. Watch from 19:29 to 20:41.
|
|
.Deep Dive
Cut Vibe Code Flaws by Up to Half
A security team vibe coded a multiplayer game. It ran fine, but any malicious player could take over any other player's computer. Then, in a broader coding test, asking AI for "secure code" cut insecure output by 8% to 19%, and having AI review its own code cut it by 30% to 50%. The tests used older models, but it's still worth trying both.
|
|
|
Industry Developments
|
AI Exploited a 22-Year-Old Web Vulnerability
A flaw in PHP, the language that runs up to 70% of all websites, was flagged in 2004 but deemed too tedious to exploit. OpenAI-backed researchers built an attack with public AI in two days. Details apparently leaked before the patch, sparking thousands of attempts. Difficulty was the defense. AI took that away.
|
|
AI Helped Solve a 31-Year-Old Math Problem
A Microsoft researcher and a collaborator just solved a 31-year-old math problem with AI's help. They didn't hand AI the problem and wait. The breakthrough came from people steering the agents, not from the model working alone. In fact, when leading AI models tried it alone, on a similar budget, they fell short.
|
|
|
|
