TL;DR
- Four handoffs have moved who is allowed to build software: hiring a developer, no-code builders such as Bubble and Webflow, vibe coding, and now app-building folded into assistants people already use.
- Grok Build is the latest step, a CLI tool for SuperGrok subscribers that plans work, runs agents in parallel, builds, tests and debugs from a plain-language instruction, with earliest access on the $300/month Heavy tier.
- The security data is stark: one study found 40 to 62 per cent of AI-generated code contains security flaws, and AI-assisted pull requests generated 2.74 times more security issues, with teams shipping four times faster and ten times as many flaws.
- The remaining skill is judgement about when a vibe-coded prototype is fine to ship and when it needs a security pass before touching a paying customer’s data.
In plain English
Vibe coding means describing an application in plain English and having an AI agent write, test and ship the code. The market numbers give the scale: Lovable moved from a $1.8 billion valuation in July 2025 to $4 billion within weeks, $6.6 billion by December after a $330 million raise led by Alphabet’s CapitalG and Menlo Ventures, and was reportedly raising again at $12 billion by June 2026, having crossed 50 million projects at around a million new ones a week. Sixty-three per cent of active vibe coding users are not developers.
The four labs are making the same move by different routes. OpenAI’s Apps SDK lets developers build MCP-backed apps that live inside a ChatGPT conversation, making the chatbot the runtime. Gemini Canvas generates a working app, game or infographic from a description in a side-by-side workspace. Claude Cowork hands Claude a task to work on autonomously. The failure modes are the ordinary ones a code review catches: hard-coded secrets, unvalidated dependencies, broken authentication and injection vulnerabilities. There is a second effect, shadow IT at scale, where non-technical staff spin up apps touching real data outside a business’s security process.
I’ve been watching the “who builds the app” question get answered differently every couple of years, and this week it got answered again. Grok now lets SuperGrok subscribers build entire apps just by describing them — no code, no platform to learn, just a conversation. That’s the third or fourth handoff of who’s allowed to build software in about a decade, and it’s worth tracing the whole arc, because the pattern tells you more than any single tool does.
Stage one: hire a developer
For most of software history, building something meant hiring a developer, or becoming one. Frameworks, infrastructure, QA cycles — the whole slow, expensive machine. That model still runs the world’s mission-critical software, and it’s not going anywhere for anything complex. But for a quick internal tool or an MVP to test an idea? It’s overkill, and everyone building lean knows it.
Stage two: no-code gets you most of the way
Then came Bubble, Glide, FlutterFlow, Webflow — drag-and-drop builders that let you assemble an app visually instead of typing it line by line. I still think Bubble deserves its reputation here: genuine full-stack control over databases, business logic, user roles, and row-level security, all without code. That’s not nothing. But “no code” was never “no learning curve” — you’re still mastering a platform’s own logic, its own conventions, its own way of thinking about what an app is. It’s a different skill.
Stage three: vibe coding, and the money says it’s real
The next jump is the one that actually broke containment: describe an app in plain English, and an AI agent writes, tests, and ships the code itself. People call it vibe coding, and I was skeptical of the name right up until I looked at what it’s actually doing to the market.
Lovable is the clearest data point. Valued at $1.8 billion in July 2025, it hit $4 billion within weeks, then $6.6 billion by December after a $330 million raise led by Alphabet’s CapitalG and Menlo Ventures, and by June 2026 it was reportedly raising again at a $12 billion valuation. That’s not hype-cycle noise — that’s four valuation steps in under a year. Lovable alone has crossed 50 million projects built, at something like 1 million new projects a week.
The category around it is growing fast too — roughly $4.7 billion in 2026, climbing at a 38% CAGR toward $12.3 billion by 2027. And here’s the number that actually matters for anyone reading this newsletter: 63% of active vibe coding users aren’t developers. It’s a founder tool that happens to write code.
Stage four: the chatbots you already use start building for you
This is what prompted the post. The newest move is the labs folding app-building directly into the assistants people already have open all day.
Grok Build is rolling out to SuperGrok subscribers as a CLI-based agentic tool: type a plain-language instruction into a terminal, and Grok plans the work, runs multiple agents in parallel, builds, tests, and debugs. Early users say it’ll organize files, generate images, even build a video game inside a project folder or wire into Unity through MCP. Grok’s also pushing into publishing full websites, apps, and 3D games straight from a prompt. SuperGrok pricing runs from $10/month (Lite) up to $300/month (Heavy), and Heavy is where the earliest access to Grok Build lives — which tells you where xAI wants its power users spending money.
OpenAI’s Apps SDK, out since October 2025, is a slightly different bet — it lets developers build MCP-backed “apps” that live inside a ChatGPT conversation, with their own tools and UI. It’s less “generate me a standalone app” and more “make ChatGPT the runtime for the app,” which is its own kind of land grab.
Gemini Canvas is the most consumer-friendly of the bunch — describe an idea in a side-by-side workspace and it generates a working app, game, quiz, or infographic, and can turn a Deep Research report straight into an interactive page.
Claude Cowork, out since early 2026, hands Claude a task and lets it work autonomously — even after you close the laptop — and rolled out fully to web and mobile by this July. Anthropic paired it with Claude Design in April for prototypes and slides.
The direction is consistent across all four labs: stop making people open a separate app-builder at all. Just talk to the assistant you already have a tab open for.
The part I won’t skip: this is genuinely riskier
I test everything before I recommend it, and the security data on AI-generated code is not subtle. One study found 40–62% of AI-generated code contains security flaws. A separate analysis found AI-assisted pull requests generated 2.74 times more security issues than human-written code — teams shipped four times faster and shipped ten times as many flaws. The usual suspects: hard-coded secrets, unvalidated dependencies, broken authentication, injection vulnerabilities — exactly the stuff a code review would normally catch before it ships.
There’s a second, quieter risk too: vibe coding scales shadow IT. Non-technical people can now spin up apps that touch real data entirely outside whatever security process a business has. Speed went up. Governance didn’t.
What I’m actually taking from this
92% of US developers now use AI coding tools daily, 41% of all code being written is AI-generated, and a quarter of Y Combinator’s Winter 2025 batch had codebases that were 95% AI-generated. This is just how software gets made now. Companies like Visa, Reddit, and DoorDash have started listing vibe-coding fluency as an actual job requirement.
For anyone building solo, the old excuse — “I need to hire a developer to test this idea” — is basically gone. The new constraint is knowing when a vibe-coded prototype is fine to ship as-is, and when it needs a real security pass before it touches a paying customer or their data. That judgment call is the actual skill now.