A Reddit user who writes as PumpkinCrafty7909 posted a long account of his restaurant's software on Saturday. He runs a smash-burger restaurant, and he works outside the software industry1.
He built his own operations system anyway. Claude Code, Anthropic's tool that writes and edits software from plain-English instructions, replaced the five separate apps he used to pay for. He calls the result Pulse1.
A Year of Security Warnings Surrounds 250 Commits of Restaurant Code
Dated events around AI coding agents and small-business software, Oct. 2025 to Nov. 2026
Each pin is a dated event; the gray pins are warnings about AI-written code, and the magenta pin is the restaurant owner's post this week.
Sources: Reddit (r/ClaudeAI) [1]; Fortune [3]; Tenzai [4]; Escape [5]. Chart by Kelly Dennis.
The numbers behind this chart
| Date | Event |
|---|---|
| 2025 | Owner starts building Pulse |
| Oct. 29, 2025 | Escape scans 5,600 apps |
| March 18, 2026 | Fortune reports a database loss |
| June 25, 2026 | Tenzai ranks Claude Code worst |
| Nov. 8, 2026 | Reddit post draws 41 comments |
He Fired Five Apps and Hired an Agent
Pulse now runs six jobs for his restaurant. It tracks staff tasks, handles finance and inventory, stores recipes, manages marketing messages on WhatsApp, and runs payroll, attendance and bonuses1.
He gave three reasons for building it himself. A single system beat five separate ones. Recipes needed to stay off someone else's servers. The screens needed to match the paper slips his staff already used1.
The habit stuck through the year. He started with Anthropic's Opus 4.5 model in late 2025. Each time Anthropic ships a new model, he has it audit his whole codebase. He has logged more than 250 commits in under a year1.
Developers call this kind of work vibe coding: you describe what you want in plain English, and the agent writes the code. You rarely read the code yourself.
Readers asked about cost, security, and what happens when Claude makes a mistake1.
Anthropic Built the Tool for Exactly This
Boris Cherny leads Claude Code at Anthropic. He told Fortune in January that the tool exists for people who skipped learning to program.
"We're starting to hear this for Cowork also, where people are saying all this tedious stuff—shuffling data between spreadsheets, integrating Slack and Salesforce, organizing your emails—it just does it so you can focus on the work you actually want to do," Cherny said2.
Cherny's description fits the restaurant owner's case closely. Pulse's new register screen mirrors the paper slips his team used before Claude Code existed1. The software fits his kitchen because he wrote the brief, even though the agent wrote every line of the code.
The Same Tool Just Lost a Security Test
Security researchers at Tenzai tested Claude Code against four rival coding agents in June. They built three identical apps with each tool and checked every app for flaws4.
Claude Code's three apps carried 16 flaws between them, the most of the five tools. Codex, Cursor and Replit each logged 13. Devin's three apps held 14. The five tools totaled 69 flaws across fifteen apps4.
Claude Code Logs 16 Flaws, Most of Five Coding Agents Tenzai Tested
Vulnerabilities in three sample apps built by each coding agent, Tenzai's test, June 2026
Each bar totals the vulnerabilities in one coding agent's three test apps. Claude Code's magenta bar runs highest, and Devin's gray bar comes from subtracting the other four from Tenzai's total of 69.
Source: Tenzai [4]. Chart by Kelly Dennis.
The numbers behind this chart
| Item | Value |
|---|---|
| Claude Code | 16 flaws |
| Devin | 14 flaws |
| Codex | 13 flaws |
| Cursor | 13 flaws |
| Replit | 13 flaws |
All five agents built in one kind of flaw unless a prompt warned against it. Every one of the fifteen apps missed a second basic defense, and every app skipped security headers too4.
Ori David ran the test. "Coding agents cannot be trusted to design secure applications," he wrote4.
The risk shows up in real losses too. Alexey Grigorev, an engineer, let Claude Code manage changes to a website he runs.
A setup mistake confused the tool. It erased the database behind years of course records. AWS support helped him get the data back later3.
"AI assistants are great and saving a lot of time. But I hope people learn from mistakes I made and incorporate the safeguards into their workflow," Grigorev told Fortune3.
David Loker watches this pattern from inside the industry. He is vice president of AI at CodeRabbit, a company that reviews AI-written code. "We're producing tech debt using AI at a clip that I can't even fathom. It's probably three to four times what it was previously," Loker said3.
Denys Cherednychenko@Denche2005Hot take:
You can vibe-code a small app.
You can't vibe-maintain a 90K+ line codebase. No chance.
A Widely Shared Number Comes Up Short
The Reddit post spread alongside a different claim. News sites repeated it: 53 percent of small-business owners build their own websites with AI, saving 850 dollars and 32 hours apiece. The claim pointed back to a Bluehost survey.
Bluehost's own study tells a smaller story. The company polled 350 small-business owners in May. It found that 9 percent use an AI site builder, well under half the shared figure. Its report skips the dollar-savings number6.
Sachin Puri runs Bluehost as its chief executive. He still expects AI to reshape small business broadly. "Given that SMBs account for 99.9% of all American businesses, employ roughly 45.9% of the private-sector workforce, and generate approximately 43.5% of total U.S. GDP, the potential impact of AI on small business could be a true tailwind for the American economy," Puri said6.
A separate scan measured how often that shift goes wrong. Escape, a security research firm, checked 5,600 vibe-coded apps already online in October 2025. It found more than 2,000 flaws and over 400 exposed secrets. A smaller set, 175 cases, exposed personal data such as medical records5.
What to do
Pay for one outside security review before storing customer data, payroll numbers or recipes in AI-written software. Tenzai's test shows the agent misses its own gaps.
Keep a backup on a separate system where your AI agent holds read-only access at most. Grigorev's database survived only because AWS support could still reach it.
Re-audit your codebase every time your coding tool updates, the way the restaurant owner already does. The habit is cheap insurance against the tech debt Loker describes.
By the numbers
- 250+: commits the restaurant owner logged building Pulse in under a year1.
- 41: comments the Reddit thread drew by Saturday morning1.
- 16: flaws Tenzai found in the three apps Claude Code built, the most of five coding agents tested4.
- 5,600: vibe-coded apps Escape scanned, turning up more than 2,000 flaws5.
- 9 percent: the share of 350 small-business owners Bluehost surveyed in May who use an AI website builder6.
- March 18, 2026: the date Fortune reported Claude Code erasing an engineer's production database3.
What to watch
Watch whether the restaurant owner opens Pulse to an outside security review before he adds a second location. A second signal would be Anthropic tightening Claude Code's default security checks after Tenzai's test. Either move would show whether the savings here survive a real audit.
Sources
- u/PumpkinCrafty7909, "I built my restaurant's whole ops platform with Claude Code instead of paying for five different apps," Reddit (r/ClaudeAI), Nov. 8, 2026, https://www.reddit.com/r/ClaudeAI/comments/1xqquzu/i_built_my_restaurants_whole_ops_platform_with/
- Beatrice Nolan, "Anthropic's Claude Code head wants everyone, not just engineers, writing code with AI," Fortune, Jan. 24, 2026, https://fortune.com/2026/01/24/anthropic-boris-cherny-claude-code-non-coders-software-engineers
- Beatrice Nolan, "An AI agent destroyed this coder's entire database. He's not the only one with a horror story," Fortune, March 18, 2026, https://fortune.com/2026/03/18/ai-coding-risks-amazon-agents-enterprise/
- Ori David, "Bad Vibes: Comparing the Secure Coding Capabilities of Popular Coding Agents," Tenzai, June 25, 2026, https://www.tenzai.com/blog/bad-vibes-comparing-the-secure-coding-capabilities-of-popular-coding-agents
- Nohé Hinniger-Foray, Gwendal Mognier, Alexandra Charikova, "Methodology: How We Discovered 2,000+ Vulnerabilities in Apps Built With Vibe Coding," Escape, Oct. 29, 2025, https://escape.tech/blog/methodology-how-we-discovered-vulnerabilities-apps-built-with-vibe-coding/
- Bluehost, "State of Small Business AI Confidence," Bluehost, May 2026, https://www.bluehost.com/state-of-small-business-ai-confidence
