Latest / Elon Musk Podcast / AI UPDATE: What is Vibe Coding, and how to make money with it

Transcript

AI UPDATE: What is Vibe Coding, and how to make money with it · Elon Musk Podcast

• 0:00
  So 45% of all AI generated code actually introduces critical
• 0:05
  security vulnerabilities. Which is, I mean, the sheer
• 0:08
  scale of that risk is just staggering when you put it next
• 0:12
  to the stories coming from business leaders right now.
• 0:15
  Take Sebastian Simi Kowski, the CEO of Klarna.
• 0:18
  He is openly shared that he has absolutely no formal coding
• 0:22
  background. None yet.
• 0:24
  He now generates completely functional software prototypes
• 0:27
  from scratch just by typing out natural language instructions.
• 0:31
  Wild. Right, he is doing in a matter
• 0:34
  of minutes what used to require an entire engineering team
• 0:37
  working for weeks. So how does the software
• 0:39
  industry harness this incredible speed of natural language coding
• 0:43
  without building digital products that just immediately
• 0:45
  collapse under their own weight? Well.
• 0:47
  We have to look at this concept Andre Carpathy talked about,
• 0:50
  which really completely changes the focus of software creation.
• 0:53
  He described a toward relying entirely on casual natural
• 0:56
  language prompts. The person creating the software
• 1:00
  essentially just ignores the underlying code, right?
• 1:03
  They focus purely on describing the desired outcome.
• 1:06
  Yeah, you completely bypass traditional syntax.
• 1:08
  Like if you sit down to build something today using this
• 1:11
  method you no longer have to worry about missing a semi colon
• 1:14
  or defining variables. Or setting up complex logic
• 1:18
  loops. Exactly.
• 1:19
  You just describe the behavior you want to see on the screen.
• 1:22
  And AY Combinator Report actually looked at their latest
• 1:25
  cohort of startups and found that a full quarter of them
• 1:28
  built the vast majority of their code bases using these exact AI
• 1:32
  tools. 1/4 of them. That is huge.
• 1:34
  Yeah, Jack Dorsey even took this approach to build an entire
• 1:39
  peer-to-peer messaging app called Bit Chat, and he relied
• 1:42
  heavily on an AI assistant named Goose to do it.
• 1:45
  I mean, think about the mechanics of how Jack Dorsey or
• 1:48
  anyone else approaches that. You fundamentally change the
• 1:51
  relationship between the creator and the creation.
• 1:54
  Instead of writing specific rigid instructions for a
• 1:57
  computer processor, you describe an application's behavior to an
• 2:00
  intermediary, and the machine handles the entire translation
• 2:04
  process into machine logic. It is remarkably similar to
• 2:08
  being a movie director instead of a camera operator.
• 2:10
  Oh, I like that. Right, like as a director you do
• 2:13
  not need to know how to adjust the focal length on the lens or
• 2:16
  how to wire the lighting grid safely.
• 2:18
  Or how to balance the audio inputs on the mixing board?
• 2:21
  Exactly. You just describe the scene you
• 2:22
  want. You dictate the mood, the
• 2:24
  action, the pacing, right? And the AI essentially builds
• 2:29
  the set, lights it perfectly, and rolls the camera for you.
• 2:33
  You direct the outcome rather than operating the heavy
• 2:36
  machinery. And that shift in roles
• 2:39
  completely alter startup economics.
• 2:41
  Yeah, it lowers the barrier to entry so drastically that
• 2:45
  non-technical founders execute complex ideas instantly.
• 2:50
  Yeah. Like if you have a solid
• 2:51
  understanding of business logic and user experience.
• 2:54
  Yeah. You no longer need to spend
• 2:55
  months hunting for a technical Co founder.
• 2:57
  Right, you completely skip the phase of securing hundreds of
• 3:00
  thousands of dollars in seed funding just to build a a
• 3:02
  minimum viable product. Exactly.
• 3:04
  A founder can now launch dozens of experimental products for the
• 3:08
  cost of what used to be a single fragile prototype.
• 3:10
  But we really have to look at the massive flip side of that
• 3:13
  incredible speed. Relying purely on AI output
• 3:17
  creates what researchers call Demo Ware.
• 3:19
  Demo Ware. Right.
• 3:20
  Yeah, these products look incredibly polished on the
• 3:23
  surface. You click the buttons, the
• 3:25
  animations are smooth. The database seems to update
• 3:27
  Florida State. But underneath the shiny
• 3:29
  interface, they are structurally disastrous.
• 3:32
  Completely Tensai Security researchers analyzed these
• 3:35
  applications and found they easily allow massive logic
• 3:38
  failures. For example, users in a newly
• 3:42
  generated e-commerce app were able to order negative
• 3:45
  quantities of item. Or sellers were successfully
• 3:48
  setting negative prices for their goods.
• 3:50
  Exactly. Because the AI understands the
• 3:52
  mechanical action of how to make a button click register in a
• 3:55
  database, but it completely misses the human business logic.
• 4:00
  It does not understand why a negative price mathematically
• 4:03
  ruins a business because it only knows how to process the input
• 4:07
  it was given. Right, Not the context behind
• 4:09
  why the application exists in the real world.
• 4:12
  Wait back up for a second. The research highlighted a
• 4:14
  specific vulnerability called hallucinated dependencies.
• 4:19
  What exactly is happening there? Why would the AI invent
• 4:22
  something that causes a security failure?
• 4:24
  Well, you have to remember how large language models function
• 4:27
  at their core. They are essentially highly
• 4:29
  sophisticated auto complete engines.
• 4:32
  They are not looking up answers in a pristine database of
• 4:35
  verified facts. They are predicting which words
• 4:38
  statistically belong together based on their training data.
• 4:41
  Right. So if your project needs a
• 4:43
  specific tool, say a PDF parser in Python, the AI statistically
• 4:49
  guesses a package name that sounds perfectly real.
• 4:52
  It follows the standard naming convention so closely that it
• 4:55
  looks legitimate. Even if that specific library
• 4:58
  has never existed. Exactly.
• 4:59
  And attackers are actively looking for those exact educated
• 5:02
  guesses. Oh absolutely.
• 5:03
  They constantly monitor public forums and public code bases for
• 5:06
  these fake names, and when they spot an AI suggesting A
• 5:09
  hallucinated library, they immediately register that exact
• 5:13
  package name in real public repositories.
• 5:15
  And fill it with malware. Right, so the the next time your
• 5:19
  AI confidently tells you to download that library, your
• 5:22
  system pulls the attacker's malware straight into the
• 5:25
  application, breaking the entire system instantly.
• 5:29
  So the AI fixes your typos, but it plants time bombs.
• 5:33
  That is exactly what happens and the consequence limits this
• 5:36
  casual AI coding to throw away projects.
• 5:39
  Yeah, it is brilliant for a weekend hackathon or an internal
• 5:43
  dashboard that only two people in your office will ever use,
• 5:46
  right? But when startups try to scale
• 5:48
  these fragile foundations, non-technical founders hit a
• 5:51
  massive brick wall. The code base becomes a tangled
• 5:55
  web of redundant logic and security holes.
• 5:57
  Because they do not understand the underlying code, they cannot
• 6:00
  fix the structural flaws exactly.
• 6:02
  They are ultimately forced to hire expensive senior developers
• 6:05
  to come in, untangle the mess, and often rewrite the entire AI
• 6:09
  generated code base from scratch.
• 6:11
  Which completely negates the initial cost savings they got
• 6:14
  from skipping the engineering phase in the first place.
• 6:16
  Yeah, and this tension between speed and stability has caused
• 6:20
  the tool ecosystem to split. We now have distinct platforms
• 6:24
  addressing completely different user needs.
• 6:26
  Right On one side you have platforms like Lovable and Bolt
• 6:30
  dot new. These allow users to scaffold
• 6:33
  full web applications entirely in the browser.
• 6:36
  They handle everything automatically exactly.
• 6:38
  Setting up the databases, configuring the servers,
• 6:41
  managing the deployment. You type a prompt and you get a
• 6:43
  live working URL. Those visual builders are
• 6:47
  perfect for getting a non-technical bounder to a
• 6:49
  working prototype in an afternoon.
• 6:52
  But on the other side of the market you have the professional
• 6:54
  tier. Tools like Cursor and Windsurf
• 6:57
  act as AI native code editors. They do not hide the code from
• 7:01
  the user. They augment the engineer who is
• 7:04
  actively writing it. Right, these tools index entire
• 7:08
  local repositories using retrieval augmented generation.
• 7:11
  You mentioned they compute numerical vector embeddings for
• 7:13
  every single file. Explain how translating code
• 7:16
  into math actually helps the AI understand the project.
• 7:19
  Well, think of a vector embedding like a massive 3
• 7:23
  dimensional map of concepts. Instead of just using a standard
• 7:27
  text search to find the exact word password, the AI maps your
• 7:32
  entire code base so it knows that authentication, login, and
• 7:36
  security token all live in the exact same neighborhood of
• 7:39
  meaning. Yeah, by converting the code
• 7:42
  into these mathematical relationships, the AI
• 7:45
  understands the full context of your project.
• 7:48
  If you ask it to change how user authentication works, it knows
• 7:51
  exactly which 50 files need to be updated simultaneously to
• 7:55
  make that happen. I have to push back on the
• 7:57
  narrative that surrounds these tools though.
• 7:59
  Really. Yeah.
• 8:00
  Does this mean human engineers are obsolete?
• 8:02
  No. I mean, if the AI knows exactly
• 8:04
  which 50 files to change and understands the context
• 8:07
  perfectly, it sounds like you do not need an experienced
• 8:10
  developer sitting there. I completely disagree with the
• 8:12
  idea of human obsolescence here. OK, why?
• 8:14
  To use Cursor effectively, particularly those multi file
• 8:18
  refactoring capabilities, you still need a deeply
• 8:21
  sophisticated understanding of software architecture.
• 8:24
  The AI might suggest just changing a Core Data model
• 8:27
  across 20 files, but the human sitting at the keyboard has to
• 8:31
  know if that specific architectural change will break
• 8:35
  the application's scalability when you hit a million users.
• 8:38
  That makes sense. If you do not actually know how
• 8:40
  to code or how complex systems interact at a high level, cursor
• 8:45
  is remarkably useless to you it. Will just help you write
• 8:48
  terrible architecture much faster.
• 8:49
  Exactly. Choosing the right tool
• 8:51
  determines the absolute ceiling of the project.
• 8:54
  A browser based builder gets your idea off the ground for
• 8:57
  market testing. But an AI native environment
• 8:59
  gives a seasoned engineer the power to safely modify massive,
• 9:03
  complex systems without breaking them.
• 9:06
  You really have to match the tool to the expertise of the
• 9:09
  user and the required lifespan of the product.
• 9:11
  Which is why we are moving away from casual prompting and
• 9:15
  entering an era of agentic engineering right?
• 9:17
  Instead of treating an AI like a Magic 8 ball.
• 9:20
  Where you submit a single request and hope it writes an
• 9:22
  entire flawless application. Developers are orchestrating
• 9:25
  fleets of autonomous AI agents. And these systems directly
• 9:30
  mirror established human engineering teams.
• 9:33
  You do not have one single agent trying to do everything at once.
• 9:37
  No, you have one agent entirely dedicated to writing the
• 9:40
  implementation code. And you have another agent whose
• 9:42
  only job is to run aggressive tests against that code to find
• 9:46
  flaws. Exactly.
• 9:47
  And you have a third agent functioning as a security
• 9:49
  reviewer, scanning specifically for those hallucinated
• 9:53
  dependencies and logic errors we talked about earlier.
• 9:56
  Frameworks like Gastown are already managing dozens of these
• 9:59
  parallel instances. We intentionally introduce
• 10:02
  friction into the process in a human team.
• 10:05
  A quality assurance testers job is to ruthlessly try to break
• 10:09
  the code the developer just wrote.
• 10:11
  Agentic engineering creates that exact same adversarial
• 10:14
  relationship between two AI bots.
• 10:17
  One bot's entire mathematical reward system is based entirely
• 10:21
  on finding the blind spots in the other bot's code.
• 10:23
  Oh wow. They collaborate, argue and
• 10:25
  refine the output continuously before a human ever reviews the
• 10:29
  final product. It is exactly like moving from a
• 10:32
  solo musician improvising a tune on a street corner to conducting
• 10:37
  a full Symphony Orchestra. That is a great way to put it.
• 10:40
  The solo musician is fast and spontaneous.
• 10:43
  That is great for a simple melody, but an orchestra
• 10:46
  involves dozens of highly specialized instruments.
• 10:50
  The conductor does not play the violin or bang the timpani,
• 10:53
  right? They stand at the podium,
• 10:54
  keeping the tempo, signaling when the string should swell and
• 10:58
  ensuring every single section is harmonizing correctly.
• 11:02
  Every instrument has a specific, highly regulated role.
• 11:06
  And the conductor's expertise is entirely in the orchestration,
• 11:09
  not the individual execution of the notes.
• 11:11
  Exactly. The consequence of this agentic
• 11:13
  approach is that it completely restores rigor to the
• 11:16
  development process. It removes the fragility of the
• 11:20
  demo where trap. It forces the human back into
• 11:22
  the role of a strategic overseer.
• 11:24
  You are the conductor, you define the constraints, you
• 11:27
  design the overall architecture, and you establish the governance
• 11:29
  rules. By doing that you build highly
• 11:32
  secure enterprise grade software at exponential speeds.
• 11:35
  Completely avoiding the security pitfalls of blindly trusting a
• 11:39
  single AI output. So the era of manually typing
• 11:42
  every single line of syntax is fading, but the discipline of
• 11:46
  planning, testing, and securing those systems is more crucial
• 11:49
  than ever. You are simply trading the
• 11:51
  manual labor of writing code for the intellectual labor of
• 11:54
  architectural oversight. It really leaves you wondering
• 11:57
  how universities will adapt their curriculums in the near
• 12:00
  future. What happens to computer science
• 12:03
  education when the highest paid skill in the industry shifts
• 12:06
  away from memorizing programming languages and moves entirely
• 12:09
  toward managing and auditing an autonomous AI workforce?
• 12:13
  If you're not subscribed yet, take a second and hit follow on
• 12:15
  whatever app you're using. It helps us keep making this.
• 12:17
  We appreciate you being here.