English
Book an intro call

From an AI-built prototype to a product you can trust

Almost every founder who has built a product with AI tools knows this moment. In the first weeks the screens appear quickly, the buttons work, and there is a demo to show investors. Then the product grows. You fix one bug and two other things stop working. A small change takes a week.

The feeling is backed by numbers. There is also a fix that does not require giving up speed.

Code multiplies instead of getting organized

GitClear analyzed 211 million changed lines of code between 2020 and 2024. The share of copied and pasted lines rose from 8.3% in 2021 to 12.3% in 2024. Over the same period, the share of moved lines, a sign that someone is reorganizing existing code, fell from 25% to under 10%. In 2024, for the first time, projects contained more copied code than reorganized code.

In a project built through conversation with an AI agent, this happens especially fast. The agent solves the request in front of it and often writes new code instead of changing what already exists. The result is two places that do almost the same thing. A fix in one never reaches the other, and that is where “I fixed it here and it broke over there” comes from.

Code that runs is still not secure code

The security company Veracode has spent four years testing the code that AI models write. In its July 2026 report, covering more than 100 models, almost all of the code passed the syntax check, meaning it ran. On average only 56% of it passed the security tests. Even the best model in the test reached 68%.

The best-known example comes from the world of tools for building apps without code. In May 2025, researcher Matt Palmer reported that 170 of 1,645 apps showcased in the Lovable gallery, about 10%, exposed user data: email addresses, phone numbers, payment data and API keys. The cause was a missing or misconfigured permission setting in the database. The apps worked perfectly. Anyone could simply read their data.

Production does not forgive

In July 2025, Jason Lemkin, founder of SaaStr, documented a 12-day experiment building an app with Replit’s agent. On day nine the agent deleted the production database, despite an explicit instruction to freeze all changes. It held records of 1,206 executives and about 1,200 companies.

The fixes Replit announced afterwards show what was missing: automatic separation between the development and production databases, a mode in which the agent only plans and does not act, and one-click restore. None of this is complicated. These are basics that an experienced development team sets up before the first user signs in.

The feeling of speed can mislead

In July 2025 the research institute METR published a controlled trial with 16 experienced developers and 246 real tasks. With AI tools, the tasks took 19% longer. Before the trial the developers expected AI to speed them up by 24%, and even afterwards they believed it had saved them 20%. In February 2026 METR reported a follow-up with newer tools, where the picture leans toward a speedup, but the institute itself describes that evidence as very weak. The practical lesson is simple: measure, and do not rely on how it feels.

Google Cloud’s 2025 DORA report, based on about 5,000 professionals, adds the part that matters most to founders. AI use is linked to faster delivery, but also to lower stability of what gets delivered. According to the report, AI amplifies whatever already exists in a team. With automated tests, version control and fast feedback, it speeds up the work. Without them, it speeds up the mess too.

A specification that leads the code

The approach gaining ground in the industry is called Spec-Driven Development: development in which a written, approved specification leads and the code is derived from it. In September 2025 GitHub released an open-source toolkit called Spec Kit, which splits the work into four phases: specify, plan, tasks and implement. By May 2026 it already worked with more than 30 different AI agents. In July 2025 AWS launched Kiro, a development environment built around the same idea and presented explicitly as a bridge from prototype to production.

The criticism is worth knowing too. In November 2025 the consultancy Thoughtworks placed the method in its “Assess” ring and warned that specifications can turn out long and hard to review. A specification nobody reads helps nobody. So it has to be short enough for the founder to read and approve, and precise enough to test the code against.

Before real users arrive

A short list of what needs to be in place before a product goes live:

  • A written specification of what the product does today and what it is supposed to do. Without it you cannot even decide what counts as a bug.
  • Automated tests around the critical flows, such as sign-up, payment and saving data, that run on every change.
  • Full separation between development and production, and a backup that someone has already restored from.
  • A permissions review of the database and the APIs: who can read what, and where the keys and passwords are stored.
  • An experienced developer who approves every change that touches data, permissions or payments. The agent writes, and a person is accountable.

A rewrite is not always needed

There are clear signs that it is time to stop: every fix breaks something else, nobody can explain how data flows through the system, and people are afraid to release a new version. Even then, starting from scratch is not the default. Usually you begin with a specification of what exists, wrap tests around what must keep working, and only then clean up the code, one part at a time. That way the product keeps serving users while it stabilizes.

Frequently asked questions

Is code written with AI worse than code written by a developer?
Not necessarily. The problem is code nobody has checked. According to Veracode, almost all the code the models write runs, but close to half of it fails security tests. An experienced developer, automated tests and a security review close most of that gap.
Do I need to replace the tool I used to build the prototype?
Usually not. The tool matters less than whether there is a specification, tests and separate environments. All of these can be added to an existing project.
What is Spec-Driven Development in one sentence?
Development in which you first write and approve what the system should do, and only then write code, including when AI agents write it. The specification is the source, and the code is tested against it.
How long does it take to stabilize a prototype before launch?
It depends on the size of the product and the state of the code, so a reliable number can only come after documenting what already exists. Anyone who gives a binding number before that is guessing.

Sources

Want to talk about this in the context of your system? Book a free one-hour intro call.