The gym story has a cleaner root cause than "obscurity is dying." The booking limit was enforced in the UI, not the API. That gap existed long before agents showed up, it just needed someone willing to skip the UI and talk to the API directly, and almost no human ever bothered. What's actually new is that skipping the UI now takes zero skill and zero motive, an agent will do it on the way to booking Pilates. The diligence question this raises for any app isn't how obscure it is, it's whether every restriction a user sees enforced client side is also enforced server side, because that's the only version of the restriction an agent will ever respect.
that’s right. agents don’t really need to deal with the gui. their view of a page looks wildly different than ours. hopefully the defaults in vibe coded apps can make the adjustments to cover this, even when not specifically asked to create secure solutions.
The gym story has a cleaner root cause than "obscurity is dying." The booking limit was enforced in the UI, not the API. That gap existed long before agents showed up, it just needed someone willing to skip the UI and talk to the API directly, and almost no human ever bothered. What's actually new is that skipping the UI now takes zero skill and zero motive, an agent will do it on the way to booking Pilates. The diligence question this raises for any app isn't how obscure it is, it's whether every restriction a user sees enforced client side is also enforced server side, because that's the only version of the restriction an agent will ever respect.
that’s right. agents don’t really need to deal with the gui. their view of a page looks wildly different than ours. hopefully the defaults in vibe coded apps can make the adjustments to cover this, even when not specifically asked to create secure solutions.