A quarter of the startups in Y Combinator's Winter 2025 batch had codebases that were 95% AI-generated. Jared Friedman, the YC partner who put that number out in March 2025, added something that gets quoted a lot less often: every one of those founders could have written the whole thing by hand. They just didn't need to.

So the building got cheap. Releasing anything didn't, and the distance between those two facts is where most of my time actually goes.

The Part That Got Easy

Getting a first working version of an idea now takes an evening, and I've written before about how completely the code-writing part of my day has moved over to Claude. What hasn't moved is everything that happens after it works on my machine.

A prototype runs on your machine, for one person who's rooting for it, under conditions you picked yourself. The moment it becomes a product it's running on hardware you've never seen, for people who didn't read the description, in countries with firm opinions about what you're allowed to collect and how you're allowed to charge for it. The code doesn't have to change much for that to happen. Everything around the code does.

That surrounding work is where development experience still earns its keep, and the awkward part is that hardly any of it is enjoyable. Nobody got into software because they wanted to fill out a data safety questionnaire. It's still the difference between something you demo to friends and something a stranger can download.

The List Nobody Demos

Every storefront keeps a list of requirements that has nothing to do with whether your app is any good, and it only ever gets longer. On the App Store that currently means privacy manifests explaining why your dependencies touch certain APIs, in-app account deletion that actually deletes rather than deactivates, verified trader details if you want to exist in the EU at all, and an age-rating questionnaire that gets reissued with new questions every so often. Google Play wants its own data safety declaration, and it runs a target API level treadmill where an app you stop maintaining isn't so much removed as quietly dropped out of search for anyone on a recent Android version.

Then there's the work no review checks at all: somewhere for people to email you, a privacy policy that matches what the app actually does, and a plan for the day someone wants their money back.

Choices You Don't Notice Making

None of it exists in a prototype, which has no strangers and no jurisdiction, and the more interesting problem is that the prototype quietly decides most of it on your behalf anyway. Cost, maintainability, how much administration you're signing up for, and which policies you now fall under are all downstream of implementation choices that felt like nothing at the time.

Adding a login is the clearest example. It takes about ten minutes and it changes what you owe forever after: password resets, a deletion flow that genuinely deletes, a support inbox for people locked out of their own data, and a breach surface that didn't exist that morning. Undercurrent keeps everything on the device instead, so there's no server-side copy to export, disclose, or delete when someone asks, and the entire category of work never opens.

Dependencies do the same thing in the other direction. An analytics SDK is one line and a shrug, and it arrives with a privacy manifest entry, a data safety declaration, a consent story in some regions, and a third party whose compliance record is now partly your problem. Licensing rides along too. VLC was pulled from the iOS App Store in January 2011 after one of its own contributors argued that Apple's usage rules imposed restrictions the GPL doesn't allow. That tension never really got resolved. It got routed around, usually by relicensing. Fonts and music work the same way, since the same file is a very different proposition in a shipped game than in a demo nobody saw.

Then there's the question of what you can fix in a hurry. A web deploy is a few minutes. A mobile build ships and then waits in review while whatever it broke stays broken for everyone who already updated. Whether you can switch a bad feature off without shipping a new binary got decided months earlier, by whether anyone bothered to put a remote flag around it. Same with crash reporting: on hardware you'll never hold, the only version of events you get is the one you instrumented for in advance.

None of these feel like decisions while you're making them. They feel like getting the prototype working.

Someone Pays for Every Call

Cost is the one that hides best, because prototypes lie about it so convincingly.

When Martin Casado and Matt Bornstein wrote up the economics of AI businesses for a16z back in 2020, the pattern they kept running into was gross margins in the 50 to 60% range, against the 60 to 80%+ that comparable software companies were posting. The cause was structural rather than sloppy, since every user action that fires a model is a variable cost, and serving one more customer never gets close to free. Inference has gotten much cheaper since then and more recent survey data has the gap narrowing, but it hasn't closed.

At a scale of one, none of this is visible, because the one user is you. Calling a frontier model on every keystroke feels fine when you're the only person doing it. At fifty thousand users it's the entire business, and by then the architecture that assumed a network round trip is holding up the roof.

Undercurrent's assistant runs on-device, which I chose for privacy first, but the side effect is that inference costs nothing per user and keeps costing nothing however many people download it. Apple's Foundation Models framework, opened to developers at WWDC 2025, makes the trade explicit: a model that runs locally, no per-token bill, and real limits, because Apple says plainly that it's built for summarizing and classifying rather than world knowledge or hard reasoning. You design the feature to fit inside that, or you pay for the alternative.

Knowing What to Ask

The useful thing is that AI is genuinely good at all of this. Ask Claude to audit your dependency licenses and it will. Ask it where your token spend is concentrated and it'll find the hot path and restructure it. It'll write the account deletion flow, draft honest answers to a data safety questionnaire, put a remote flag around a risky feature, and talk you through what changes if you keep the data on the device instead of on a server. None of this is beyond it, and most of it takes minutes.

It just won't raise any of it on its own. A model answers the question you ask, and it doesn't tell you the question was wrong or incomplete. The expensive mistakes live almost entirely in the questions nobody thought to ask, which is why experience has moved rather than evaporated. It's in knowing that a login is a permanent obligation, that a free dependency asks for something in return, that the cost curve bends somewhere past your current user count, and that the thing you can't switch off remotely will eventually need switching off.

I ran into a small version of this with a quantized Llama 3.2 3B running through ExecuTorch inside an iOS app. On my laptop it was excellent. On an actual iPhone it kept dying, because iOS runs a daemon called jetsam that kills any process crossing roughly half the device's RAM, instantly and without warning, and a 3B model plus a real app's worth of views and caches doesn't fit under that ceiling. Once I could see what was happening it wasn't hard to work around. The part that stuck with me is that I hadn't considered the memory ceiling at all, and nothing about the prototype was ever going to prompt me to. You find out by having the experience, and then you know to ask about it forever after.

Which brings me back to Friedman's aside. Those founders could all have written their own code, and it had stopped mattering that they could. What still mattered was everything they knew to ask about, none of which ever showed up as code.