Anyone Can Code Now. So What Are You Paying For?

A client used to accept a two-week timeline and a $2,000 quote for a task tracker without blinking. Now they open Claude or Lovable, describe what they want, and have a working version in five minutes. Their next question isn't "when can you start," it's "why would I pay you for this."

That question is the whole piece. Software is becoming a commodity, and like every commodity, its price is falling toward the cost of production, which for code is now close to zero. What's left standing after that price collapse is worth examining carefully, because it isn't nothing, and it isn't everything either.

Three axes of capability growth

The AI coding curve didn't move in a straight line, it moved on three axes at once: speed, breadth, and depth. Speed is obvious, models that once took minutes to generate a working function now scaffold entire applications in the same span. Breadth means a single model now competently handles dozens of languages and frameworks and can adapt to industries from fintech to healthcare without retraining. Depth is the harder one to see, it's the difference between code that runs and code that holds up, and it's improved too, though unevenly.

The outcome-versus-code debate

There's a genuine argument circulating that code was never really the point, the outcome was. If someone wants a button that tracks tasks, they don't care whether a senior engineer wrote elegant, well-tested code or an AI tool assembled something functional in an afternoon. Up to a point, this is correct. For low-stakes, single-user, disposable tools, the outcome is the entire spec, and paying a premium for craftsmanship nobody will ever inspect is wasted money.

The argument breaks down once stakes rise. The boundary isn't about how the software looks or feels, it's about what happens when it's wrong, when it's attacked, or when it needs to grow. A personal to-do list and a payment processor are both "just an app" until one of them leaks a credit card number.

What still requires engineering

The data on AI-generated code in production is not reassuring for the "outcome is all that matters" camp. Veracode's evaluation of over 100 large language models found 86% of AI-generated code samples failed to defend against cross-site scripting, and 88% were vulnerable to log injection. Georgia Tech's Vibe Security Radar tracked CVEs formally attributed to AI-generated code rising from 6 in January 2026 to 35 in March, with researchers estimating the real number is five to ten times higher since most issues never get a formal CVE. A study that built the same application fifteen times using five different AI coding tools found that all fifteen versions introduced a server-side request forgery vulnerability in the URL preview feature, because none of the generated code verified the host before fetching a URL.

One incident makes the pattern concrete: a social platform for AI agents called Moltbook was built entirely through vibe coding, and a researcher found its database was configured with public read and write access, exposing 1.5 million API keys and 35,000 email addresses. Nobody had reviewed the infrastructure code before it went live, because reviewing it was the exact step the workflow was designed to skip. This is what "you don't know what's going on in the background" costs when the background matters.

Good engineering principles exist to catch exactly these failure modes before they reach users; they're what keeps a system correct when the person prompting it doesn't know what a misconfigured permission looks like. This is not an argument against AI-generated code, it's an argument that generation and review are different skills, and the second one hasn't been commoditized yet.

What actually differentiates a developer now

If code itself is cheap, the question becomes what a client is actually paying for when they hire a person instead of opening a chat window. Two things hold up.

• Range: having built across domains (voice apps, legal tech, fintech et al) means recognizing failure patterns before they happen, not after
• Domain expertise: twenty years in fintech teaches someone what regulators, edge cases, and real users actually break, which no general-purpose model has encoded
• Judgment under scale, security, and privacy constraints: knowing when a shortcut is fine and when it's a lawsuit waiting to happen

These aren't marketing language, they're the specific things a generic coding tool cannot supply because they come from having been wrong before and learning what wrong costs.

The same repricing is hitting consulting

Software engineering isn't the only field where AI is breaking the link between time spent and value delivered. McKinsey has said its internal AI tool, Lilli, saves consultants roughly 30% of their time on research and synthesis work. Firms like Vaimo have already moved to value-based pricing instead of hourly billing, describing it as a direct response to clients being able to see that work AI used to take weeks now takes an afternoon. The logic is identical to a developer being told "I can build a mini version of this myself in an hour," a client who can see the AI-assisted floor of a task will no longer pay for the pre-AI ceiling of it.

The pattern across both fields is the same: the billable unit (developer hours, consulting hours) is being decoupled from value, and the professionals who survive the repricing are the ones who can point to something the tool can't replicate, whether that's judgment, domain memory, or accountability when something breaks.

What this means going forward is that software engineering isn't disappearing, it's being sorted. The bulk of small, disposable, low-stakes projects will keep gravitating toward AI tools and their five-minute price point, and that's a reasonable outcome for work that never needed a specialist. What remains billable at a premium is the part that was always harder to fake: knowing which decisions are irreversible, which shortcuts compound into breaches, and which fintech app patterns break in production three years after launch. That knowledge doesn't show up in a prompt, and for now, nothing has commoditized it.