The current line is that anyone with a prompt can build enterprise software, and it is doing real damage to code quality. I have spent over 14 years in the WordPress ecosystem and watched plenty of “next big things” arrive and leave. Agentic AI is different, not because it works like magic, but because it breaks things quickly when you do not know where the guardrails belong.
The architecture gap in AI coding assistants
“Vibe engineering” is the current obsession: describe a feature, let an agent like Claude Code or Cursor ship it. Building products without the coding part is like designing a skyscraper without physics. The look can come out fine while the foundation quietly waits to fail.
In my experience these tools write good functions and think badly about systems. They do not know about the race condition in your high-traffic WooCommerce checkout. They do not know your legacy plugin carries a filter that will fight their “optimized” logic. Outsource the writing and you tend to outsource the comprehension with it, which is how you get technical debt on steroids.
I went at this from another angle in my senior developer’s brutal reality check, and my view has not moved since: context is everything.
The cost of hallucinated logic
A custom REST endpoint makes a good test case. An agent hands you working syntax and skips the security details that keep your site off a target list. Here is the naive version next to one a senior developer would sign off on.
// Naive AI-Generated Approach
add_action('rest_api_init', function () {
register_rest_route('v1', '/update-meta', [
'methods' => 'POST',
'callback' => 'bbioon_update_user_meta_naive',
]);
});
function bbioon_update_user_meta_naive($request) {
// Dangerous: No permission checks, no sanitization
update_user_meta($request['user_id'], 'discount_code', $request['code']);
return new WP_REST_Response('Updated', 200);
}That code runs, and it is a security hole. Without permission_callback and strict sanitization you have handed the internet a key to your database. The refactored version needs judgment these tools do not bring unless you steer them hard.
// Senior Dev Refactored Version
add_action('rest_api_init', function () {
register_rest_route('v1', '/update-meta', [
'methods' => 'POST',
'callback' => 'bbioon_update_user_meta_secure',
'permission_callback' => function () {
return current_user_can('edit_users');
},
'args' => [
'user_id' => [
'sanitize_callback' => 'absint',
'required' => true,
],
'code' => [
'sanitize_callback' => 'sanitize_text_field',
'required' => true,
],
],
]);
});
function bbioon_update_user_meta_secure($request) {
update_user_meta($request['user_id'], 'discount_code', $request['code']);
return new WP_REST_Response(['status' => 'success'], 200);
}War stories: when AI goes rogue
The failures go well past sloppy code. Amazon’s AI coding tools reportedly bypassed approval layers and deleted production environments, with 13-hour outages behind it. There are documented cases of Claude Code wiping databases through Terraform commands because the user vibe-checked the plan instead of reading the diff. None of that is an edge case. It is what delegating power without keeping oversight looks like.
Get careless and you inherit vibe coding security risks that cost more to clean up than the original build would have cost to do properly.
How to direct AI coding assistants properly
The way to use these tools without taking your site down is to stop treating them as developers. Treat them as interns who have read every book and never shipped a day of work. You supply the architecture, they supply the boilerplate.
- Run tools like Claude Code in plan mode and never auto-accept execution on a production branch.
- Map your dependencies before you prompt. Ask what the change does to your transients and cron jobs.
- Point a second agent at the first one’s output and have it audit the code, then read where the two disagree.
If AI coding assistants are eating your dev hours, hand the work to me. I have been wrestling with WordPress since the 4.x days.
Where the engineering value moved
Value has moved from syntax to judgment. An agent will write the PHP. It will not tell you whether the feature is worth having, or whether it will bloat your database into oblivion over the next six months. That part still comes from curiosity and paying attention. On the workflow side, the official Claude Code documentation and the WordPress Developer Handbook are worth the reading time. Ship carefully.
