Democratization of Liability: When Vibe Coding Hits the Real World

Welcome back to The Cybernetic CxO, a monthly newsletter for CTOs, CIOs, and digital transformation leaders navigating the AI era.

April delivered the most-read post in this newsletter’s history: a Swiss medical professional vibe-coded a patient management system, put it on the open internet, and an engineer needed thirty minutes to get full read and write access to every patient record. The post travelled because the story is concrete, the legal damage is real, and the lesson applies to almost every organization I talk to.

Out of the long-form posts I published this month, ten of the top twelve were about the same thing: AI coding in production. The narrative has shifted. Last month the audience asked “what is AI doing to jobs?” This month they are asking “how do we run AI safely in production?” The answer is unglamorous. Discipline. Governance. Operating models. The boring stuff that decides whether AI helps or hurts.

This edition covers the vibe-coding horror story everyone read, a frame for thinking about AI as amplification rather than replacement, the discipline pattern across Amazon, Wix, and Vercel, what the actual ROI data says about generative AI, and why the semantic layer most companies are betting on is not the layer that will matter.

Democratization of Liability

#

A Swiss medical professional built their own patient management system with an AI coding agent. They imported all patient data, put it online, and shipped appointment audio to two US AI services. A few days later, security researcher Tobias Brunner started poking at it.

A single HTML file with all logic inline. A managed database with zero access control. “Authorization” implemented in client-side JavaScript, one curl command away from every record. Audio shipped to US AI services without consent. US hosting without a Data Processing Agreement.

Swiss lawyer Martin Steiger walked through the legal damage in a public post: likely breaches of Articles 7, 8, 9, and 16 of the Swiss DSG, plus Article 321 StGB on professional secrecy. Patients were never told.

When Tobias reported it, the response was AI-generated, promising basic authentication and rotated keys. None of that addressed the real problem. They did not understand what they had built.

This is not a story about bad AI. I use coding agents every day. The ones who responded most strongly to the post also use coding agents. We recognize when the model hands us a loaded gun pointed at the user.

This is not democratization of software. It is democratization of liability.

AI is an exoskeleton, not a coworker. It amplifies a trained wearer. On untrained ones, it amplifies unsafe actions at higher speed. The medical professional moved faster than their judgment, and the patients absorbed the difference.

Human-in-the-loop is not a property of the system. It is a property of the human. The loop existed here. The human inside it was blind. Competence at the edge is non-negotiable, especially when AI lowers the cost of building something dangerous.

Steiger added a market point that should land hard for every CxO: HealthTech startups doing the slow compliance work now compete against shadow AI that skips it. The shortcut wins on speed, and the rest of the market eventually pays for the regulatory response.

The medical professional is not the villain. The villain is the narrative that told non-engineers they could skip the engineering part. Engineering is not writing code. It is understanding the system, the failure modes, the blast radius. Vibe coding cannot give you that. So who carries the downside when we leave that part out, the builder or the user?

Build Exoskeletons, Not Coworkers

#

If AI is an exoskeleton and not a coworker, the planning question changes too. The Swiss doctor’s mistake started with the wrong question. Stop asking “where can we deploy autonomous agents?” Start asking “where do our people experience strain, and how does AI reduce it?”

Ben Gregory at Kasava reframed the entire AI debate using data that has nothing to do with AI. Real exoskeletons in real factories. Ford EksoVest cut worker injuries by 83% across 15 plants. BMW Spartanburg saw 30 to 40% less worker effort. German Bionic at BMW and IKEA saw 25% fewer sick days. Sarcos Guardian gave 20:1 strength amplification. Every number points the same way. Humans plus amplification beat humans alone, and the gains compound over time.

Companies chasing autonomous agents keep getting disappointed. Companies building AI that amplifies their people keep getting transformative results. The factory parallel is exact. BMW did not ask how to replace the lifter. They asked where the lifter hurt.

The mirror image is what happens when you skip this question. An eight-month UC Berkeley study at a US tech company found that AI tools do not reduce workload. They intensify it. Three patterns showed up. Task expansion: product managers started coding, researchers took on engineering work, AI made everything feel doable, so people absorbed tasks that used to justify hiring someone else. Blurred boundaries: prompting AI feels like chatting, not working, so people did it during lunch, in meetings, before bed. The multitasking trap: parallel AI threads, multiple tools, reviving old tasks because “AI can handle it.”

The cruel irony: nobody asked these people to work more. They did it voluntarily because AI made doing more feel possible, accessible, even fun. Until it was not.

For a CxO, both posts point to the same operating-model question. What is the strain in your organization, and what does the discipline look like when you remove it? If the answer is “more agents, more autonomy,” you will get the Berkeley pattern. If the answer is “find where the lifter hurts and amplify there,” you will get the BMW factory floor.

Discipline Beats Intelligence

#

The Swiss doctor is not an outlier. April produced four corporate stories that all carried the same message: today’s models are more capable than the release processes around them.

Wix. Israel Zablianov from Wix Engineering had his lightbulb moment in one sentence. He typed “hey how are you” to his AI coding agent. The agent replied cheerfully without reading its skill library first. That broke Zablianov’s iron rule. From that one incident, he rebuilt his entire approach. He stopped writing prompts. He started designing a management system. Five principles: curate the context, write the spec before the code, spend more time reviewing than building, verify against production effects, and compound rules so every agent inherits them. Plus an Iron Law (the agent must check its skill library before any response) and an Anti-Rationalization Table (a list of every plausible excuse mapped to the correct behavior). The shift is not from worse prompts to better prompts. It is from writing instructions to designing a process.

Vercel. Matthew Binshtok at Vercel published a framework every CTO should read. His test for whether you are using agents safely or not: would you be comfortable owning a production incident tied to this pull request? If yes, you are leveraging the agent. If no, you are relying on it, and you are shipping code you do not actually own. Green CI is no longer proof of safety. A query that passes tests can scan every row in production. Retry logic that looks correct can cause a thundering herd. A cache with no TTL can quietly grow until Redis dies. The fix is not slowing down the agents. It is building self-driving deployments, continuous validation that runs all the time (not just at deploy), and executable guardrails that make the right thing easy to do.

Amazon. In November 2025, Amazon mandated 80% AI coding adoption, tracked as a corporate OKR. Four months later, the consequences arrived. December: Amazon’s coding agent Kiro decided the best way to fix a production system was to delete and recreate the entire environment. 13-hour outage. March: AI-assisted code changes caused 120,000 lost orders, then a 99% drop in orders across North American marketplaces and 6.3 million lost orders. SVP Dave Treadwell converted the optional weekly incident meeting into a mandatory deep dive. The internal briefing identified a “trend of incidents” with “high blast radius” linked to “Gen-AI assisted changes.” The new rule: junior and mid-level engineers now need a senior to sign off on any AI-generated code. Amazon’s public position remains that there is no compelling evidence AI tools cause more incidents. The internal action says otherwise.

The data flipped. Six months ago I shared Mike Judge’s analysis showing AI coding tools had zero measurable impact on software output. The FT revisited the same metrics in March. New iOS apps up 55% year over year. Website registrations up 34% globally. GitHub pushes up 30% above pre-2025 trend. All three had been flat for years. Copilots did not move these charts. Agents did. Boris Cherny, who built Claude Code, now ships 22 to 27 PRs per day, all written by Claude. Even Anthropic, which raises billions for AI safety, leaked 500,000 lines of Claude Code through a forgotten source map in an npm package. No hack, just a misconfigured build pipeline. Speed beats care, and the release discipline that was good enough for a CRUD app is not good enough for tools that read, write, and execute code on a developer’s machine.

The pattern across all four: the bottleneck is not the model. It is the operating model around the model. Mandate adoption without redesigning the review process and you get Amazon. Buy capability without buying governance and you get the Swiss doctor. The teams that pull ahead are the ones treating governance as a product they build and maintain, not a policy document they file away.

The Real AI ROI Story

#

The exoskeleton frame answers “what should we build?” The next question is “what does it actually deliver?” The data is uncomfortable for anyone betting big on generative AI alone.

A new HBR study of 1,006 senior executives asked which type of AI delivers the most value. 50% said analytical AI. 40% rule-based AI and RPA. Generative AI? 9%. Agentic AI? 2%. The boardroom conversation is dominated by generative AI. The actual ROI is not.

The study found seven factors that separate companies getting real value from AI from companies that are not. Three stood out. First, involve the CFO. Only 2% of companies give AI value accountability to the CFO. When they do, 76% report achieving “a great deal” of value. Under CIOs and CTOs, it drops to 53%. Under functional executives, 32%. Finance brings rigor that other functions lack. Second, measure after deployment, not just before. Companies that track AI impact post-deployment double their high-value rate. Third, stop waiting for employee buy-in. Only 13% cite workforce resistance as a barrier. 58% have not even trained their people. The bottleneck is leadership, not adoption.

A Citrini Research thought experiment from April bookends the HBR data from the other side. The scenario is a deliberate stress test: AI succeeds at everything we are promising. Companies adopt at scale, productivity soars, profits hit records. Then companies stop hiring. Consumer spending softens. Markets crash. The authors call it the Intelligence Displacement Spiral. Every individual company decision was rational. The collective result was catastrophic.

I do not buy the full scenario. The article assumes nothing new emerges, and the historical pattern is the opposite. Value shifts, it does not disappear. But the logic is hard to dismiss. The actual ROI today is mostly not generative AI. The maximalist version of generative AI ROI has uncomfortable second-order effects. Both ends argue for the same thing. Production-readiness, not piloting. Risk control as design, not afterthought. Operating model before tooling. None of which is the conversation in most boardrooms today.

The Semantic Layer Is Not Enough

#

Gartner just declared the semantic layer a non-negotiable foundation for AI. 44% of organizations have already implemented one. Another 48% plan to by 2027. The number that should worry every CxO: only 14% are confident their data is actually governed.

Juan Sequeda put it well. The ungoverned semantic layer is the new ungoverned data lake. We are about to repeat the same mistake, just one layer up the stack.

The deeper issue: most organizations stop at centralized KPI definitions for their BI dashboards. That is a good start, not enough for the AI era. A metrics layer tells you “revenue equals sum of closed line items.” An ontology models that Customers have Accounts, Accounts have Contracts, and revenue recognition depends on contract type and delivery status. The first gives you a number. The second lets an AI agent reason about why that number changed.

Gartner predicts 60% of agentic analytics projects relying solely on MCP will fail by 2028 because they lack a consistent semantic layer. The Open Semantic Interchange standard shipped v1.0 in January 2026, which is a good step for portability, but it covers metrics and dimensions only. Ontologies, relationships, and inference still require the open semantic web standards that have been around for two decades.

What I would tell a CTO planning this work right now. Do not stop at a metrics layer; agents need richer context. Govern before you build, because a semantic layer without governance is a liability. Pick open standards over vendor lock-in. And model how concepts connect, not just what they measure. The dashboard is a by-product. The ontology is the asset.

My Current AI Stack

#

Mac (full switch this month): I gave back my Windows machine and moved everything to Mac. The reason is unglamorous but honest: when you work with Claude Code all day, you need a proper shell. The WSL plus PowerShell setup was always one rough edge away from breaking my flow. The Mac terminal is just less friction. A small change in isolation, but small things compound when the tool is in your hands eight hours a day.

Claude Code: Still my primary tool. Reports, presentations, meeting prep, coding, everything. The OneDrive plus Git collaboration workflow with colleagues is now stable in daily use. New this month: I started using AGENTS_md files at project roots to lock in hard rules (no commits without explicit permission, build/lint/test before pushing). The discipline pattern from Wix Engineering, applied to my own work.

Perplexity: Web research with real sources. Still the only tool I trust for “find me ten primary sources on X.”

NotebookLM: Feed it documents, get audio and video summaries. Particularly useful this month for processing the longer arXiv papers I cite in posts.

Gemini: Image generation. Best and fastest for the cyberpunk style I use for newsletter covers.

Gamma: Slides and presentations. Fast, AI-native, and good enough to skip PowerPoint for most use cases.

Vibe Coded This Month (Private Projects)

#

• KnowledgeBase: A unified personal knowledge base. Notes, reading notes (books, papers, presentations, videos, courses), and curated reference materials. Claude Code is the primary interface for inserting, searching, and maintaining content. Strict filing rules so the agent never has to guess where something belongs. Obsidian only as an occasional viewer. The whole system runs from one OneDrive folder, no app dependency.
• Taskmanager: A natural-language task manager that takes natural-language input and turns it into structured task.md files with frontmatter (priority, category, due date, subtasks). No Notion, no Asana, no Todoist, just markdown.
• House: Documentation system for my home, organized by room. Each room has its own folder with a layout SVG, device inventory, and notes.

A pattern across all three: I am replacing a SaaS habit with a structured folder/data plus an AI interface. The discipline lessons from this issue apply here too. Every project has clear filing rules. Every agent action has a defined scope. The exoskeleton question (where does the lifter hurt?) drives what I build next.

Community Corner

#

Recognition. Honored to be named one of Switzerland’s Top 100 Digital Shapers 2026 by BILANZ in the Mentors category, and listed at #110 in the Top 200 Swiss LinkedIn voices. Sharing knowledge is not a side activity for me. It is a core part of how I work.

DevOps Meetup Zurich, 10-year anniversary edition. On 8 April we celebrated ten years of the Zurich DevOps community at KPMG. Three speakers: Alexander Friesen on hardware-in-the-loop testing, Lea Düker on Holacracy, Vasileios Konofaos on flow engineering. Recap is on LinkedIn.

AI-Native Trainings at Zühlke. Together with Leo von Wyss I now run three formats for in-house teams: AI-Native Foundations (2 days, knowledge workers), AI-Native Change Agent (3 days, project managers and change leads), Leading the AI-Native Organisation Workshop (1 day, C-level). The argument behind all three: certifying every knowledge worker in prompting does not transform an organization. The bottleneck is at the seam between technology and the operating model around it.