AI Security Warnings, Agent-Built Apps, and a $300K MRR Milestone

Key Takeaways

1. Security researchers warn that AI-assisted vulnerability discovery is becoming a new normal, with exploits expected across all languages and frameworks.
2. A Proof Driven Development approach from Microsoft Research aims to shift engineer review from code to formal specifications.
3. Postiz crossed $300K MRR with roughly $5K in daily revenue, while an 18-year-old's AbMaxx app reached $55K monthly revenue in six months.
4. Replit's CEO says vibe coding flips the programmer's time split, and the company now values at $9B.
5. A cost breakdown of a $20 Claude subscription traces where the money goes, from GPUs to power grid constraints.

1. AI and Security

1. Patrick McKenzie said security is entering a "very weird" new normal that applies to many non-security fields too, and suggested the day might be one of the last relatively quiet ones for vulnerability news 1. Arvid Kahl said the previous day's flood of vulnerabilities helped him understand why frontier AI models carry internal triggers for cybersecurity prompts, and argued the transition period for finding and patching old software's many flaws will be painful 2. @levelsio argued AI-assisted exploits will hit all languages and frameworks, not just PHP, citing Node's high-severity patch this week, and described a new phase of an AI-assisted cat-and-mouse game on both attack and defense sides 3; he also relayed that Railway was hacked 4. Tony Dinh remarked on the volume of security disclosures over the past two days 5.
2. Arvid Kahl argued for abandoning the concept of EOL (end of life) itself 1, and highlighted that the Sury PHP image maintainer backported patches to 5.6, calling it a "huge public service" 2. He also described PDD (Proof Driven Development) as the way forward: TDD is good, but agent-written tests are so cheap that many developers skip review, while PDD could improve clarity and precision. The cited post describes Microsoft Research's PDD Kit, which turns plans into formal specifications, uses Verus to prove Rust code meets them, and falls back to tests and a computer-use agent's empirical validation when proofs fail, aiming for engineers to review specifications rather than code 3.

2. Agents, Development, and Products

1. Arvid Kahl pushed back on the "hand-write only" stance: rather than manually changing one config line, he would have an agent raise a queue size from 3 to 10, check side effects and resource contention, and update docs in sync. He argued agents can assess a change's impact on the whole system and load, locate docs needing updates, spot potential races, and run all available tests, and that small changes causing unexpected cascading effects are markedly rarer in agent systems with full context and focus 1.
2. Codie Sanchez relayed Replit CEO Amjad's view that LLMs can produce highly complex results but lack free will, intent, or inner experience, so appearing intelligent is not the same as being conscious 1. She also relayed that Amjad pitched Peter Thiel in 2022 and was told he was using "buzzwords" and selling "hype"; four years later Replit is valued at $9B, and she said 85% of Fortune 500 companies have someone internally using its product 2. On vibe coding, Amjad said programmers used to spend 80% of their time on infrastructure and 20% on solving problems, a ratio now reversed, with key skills shifting to translating business problems into clear instructions, understanding what to build, and communicating effectively; Replit's latest Agent can build apps, designs, slides, and dashboards from natural language 3. She added that Replit has product managers interview its unhappiest users weekly and bring failures back to company meetings 4.
3. Alex Lieberman reviewed ChatGPT Dots: it excels at directing other AIs, can supervise Codex building an entire app while he sleeps, and can take a "call" from a park bench, but creative work still needs human oversight, and the $100 monthly upgrade is not worth it for most people 1 2. The forwarded content said Dots differs from plugins and connectors in that it can browse the internet on its own computer, and offered upgrade guidance: use it alongside a Pro plan you already intended to buy, ask an admin if on Business Premium or Enterprise, and otherwise start with free Muse or the $20 GrokBot 3 4.

3. Revenue, Pricing, and Costs

1. Starter Story reported that Postiz's MRR has passed $300K, with ARR expected to exceed $4M next month; it is adding about $5K per day with 1,664 weekly active trials, growth did not cool after OpenClaw's launch, and the target was raised from $5M to $20M ARR 1. It also profiled 18-year-old college dropout Lino, who learned vibe-coding on YouTube and built the ab-scanning app AbMaxx, which offers lower-ab scoring, body-fat percentage, and training plans; it reached $55K in monthly revenue six months after launch, with 16K downloads and over 3,000 paying users in the last 28 days 2. Lino built V1 with Lovable over two months but scrapped it before launch, then rebuilt V2 with Rork in one month, hitting $7K in its first month 3. On growth, he called working with large UGC influencers his "biggest mistake" at only 5-10% margins; he later gave one large fitness influencer equity for free ads and moved Meta creatives to TikTok for a 5-6x improvement, scaling on Meta and TikTok at 2-5x ROAS 4. He advised launching within seven days, validating demand with faceless TikTok slideshows and a "comment APP and I'll send it" CTA, and listed his stack as Rork Max, Supabase, SensorTower, and PostHog 5.
2. Alex Lieberman broke down where a $20 monthly Claude subscription goes: a prompt is split into about 5 tokens while Claude reads thousands of tokens of system prompt, and Anthropic keeps about 65% ($13) for training the next model, research, and staff 1. In the same breakdown, tokens travel round-trip over fiber in about 40 ms at a cost of $0.02; GPU rental is $2.48; cooling is $0.84, with a 72-GPU rack drawing 120-140 kW, roughly the usage of 100 US homes, almost entirely converted to heat; chip compute is $2.88; chip manufacturing is $0.30, almost certainly by TSMC; power delivery is $0.41, with new grid connections taking 5-7 years as the biggest bottleneck; and land, steel, copper, and concrete infrastructure is $0.07 2. Generating an answer of about 700 tokens over roughly 12 seconds is counted at $0, and each token involves billions of multiplications 3.
3. Acquire.com listed several businesses for sale: a SaaS syncing Stripe data for a German bookkeeping tool with $158K TTM revenue asking $523K 1; an award-winning mobile scheduling app with $729K TTM revenue, up 65% year over year, rated 4.7 stars, asking $1.2M 2; a Shopify bundle and upsell app with $624.4K TTM revenue asking $3M 3; and a three-brand e-commerce portfolio with $230K cash flow, a year of coaching included, $375.9K TTM revenue, asking $749.9K 4. It also relayed a view on rejecting a $6M acquisition: that is a $6M bet on yourself, and founders should ask whether they would spend $6M to buy their own company today; accepting and moving to the next idea is equally reasonable 5. It noted acquisitions consume founder time while the business keeps running, and M&A advisors can absorb that work 6.

4. Founder Strategy and Operations

1. Alex Lieberman argued the fundraising experience depends on bargaining power: with maximum leverage, the process is faster, you go from chasing to being chased, and you need only tell the truth about reality rather than polish it; maximum leverage comes from an already-built business that is high-growth, profitable, and not dependent on outside capital to survive 1 2. Noah Kagan said he qualified for X's creator payouts and shared tactics for raising verified users' views: posting twice a day instead of once every three days, at least six hours apart; re-releasing underperforming content with a new hook on the same data, which took views from 7K to 27K; two prompt posts each getting 1,300+ bookmarks; and 17 posts driving 64% of views. He said verified-user views rose from 292K on September 15 to 500K on October 20, that posting his own X data performed poorly, and that his first payout amount is not yet announced 3.
2. Codie Sanchez argued everything is negotiable and called negotiation one of the highest-return skills: a business owner in her community accepted a loan at 49% interest for lack of time to compare, and a loan advisor found a 22% loan within days, saving over $1,000 a month in interest 1. Nick Huber observed that business input and growth are not linear: a business worked 50 hours a week may grow more slowly and with more stress than one worked 10 hours a week, and six months later the situation can reverse 2. He also argued many ordinary-qualified people who make big money share a lack of insecurity: they are confident enough not to be swayed by others' opinions, dare to ask, market, and make cold calls for days or weeks when business is slow, and do not wallow or second-guess strategy when a call or event fails 3.