Cloudflare just broke all the rules
In a Nutshell
Cloudflare used Claude AI to rebuild Next.js as V/Next in one week for $1,100, creating a 4x faster, production-ready alternative on Vite that passes Next.js's test suite without reading its code—dubbed a "heist" freeing users from Vercel lock-in. Vercel CEO Guillermo Rauch slammed it as "vibecoded" insecure junk with vulnerabilities, despite his prior tweets hyping AI-generated software via test suites. This sparks debate on synthetic AI code's future: reckless opacity vs. evolution-like innovation enabling impossible complexity beyond human engineering.
These notes were generated by AI and may contain inaccuracies.
Cloudflare pulled off one of the most massive heists in internet history, bigger than The Italian Job or National Treasure. They stole Next.js using Claude AI in one week for $1,000.
Dane Crescenzi (CTO of Cloudflare and angel investor) announced February 24, 2026 as Next.js Liberation Day.
Cloudflare team posts in a sloppy way, similar to Y Combinator. CEO Matthew Prince retweeted a warning about unexpected $100 Cloudflare bills (later un-retweeted).
Next.js is a framework built on React for shipping web applications easily, customized for Vercel's cloud platform. It's awkward to use outside Vercel. Solutions like Open Next (backed by Cloudflare and Netlify) exist, but hard to maintain due to constant Next.js updates.
Cloudflare rebuilt Next.js with AI in one week. Engineer Steve Faulknor spearheaded it, resulting in V/Next built on Vite. Cost: $1,100 in tokens, 4x faster. Fully vibe-coded without looking at Next.js code—they brag about it. Already running in production, including government websites, works well on Cloudflare.
AI struggles to build a Next.js clone without guidance but excels with automated validation criteria. LLMs search language space effectively if given tests to pass.
OpenAI's recent physics breakthrough used automated validation.
Next.js has an elaborate test suite with thousands of end-to-end tests covering every feature and edge case. This enabled the clone despite Next.js's massive codebase (tens of millions in development costs, dozens/hundreds of engineers, extensive docs, Stack Overflow).
LLM acts like a smart monkey in probabilistic space; tests provide the check.
Steve used Claude, steered the agent as a skilled engineer familiar with Next.js internals. Next.js codebase bloated with human abstraction layers for reasoning; AI skips them, vomits directly to solutions, resulting in smaller codebase.
Dramatic 'heist' since open source, but Vercel CEO felt robbed. Cloudflare's acknowledgments: thanks to Vite team, 'acknowledge' Next.js team (not thanks), showing acrimony.
Vercel CEO Guillermo Rauch identified and disclosed: 2 critical, 2 high, 1 medium, 1 low severity vulnerabilities in V/Next ('vibecoded' accurate term). Getting paid via Cloudflare bug bounty to humiliate them. Long rivalry between the two.
February 18 (week before Liberation Day), Steve tweeted: "Prediction, this year we'll see some open source projects make their test suites private, like SQLite." Revealed as prescient due to the heist.
SQLite keeps tests proprietary (pre-AI), genius as tests control product changes. Questions open source purpose if no legacy/maintainability freedom.
Guillermo butt-hurt: if Cloudflare forked with human code, he'd applaud; instead, vibe-stole without contributing back. Asks: what service to build next with investment in security/availability/durability (shots at V/Next).
Pre-Liberation Day tweets:
- January 8: "All software will be generative and generated. Adjust accordingly."
- August 6, 2025: "Software engineering will be completely unrecognizable in 5 years likely less."
- December 13: "No limits anymore. Anyone can do anything. Only limiting factors are agency and ambition and the test suite. You can just ship things."
Cloudflare did exactly that; he got mad.
Guillermo's G's Last Exam (Turing Test thresholds):
- Examples like rewrite TypeScript compiler in Rust with better performance.
- V/Next fits: rewrote Next.js (same language) with better performance, identical API/semantics.
Suggest updating to include recreating Next.js.
Dual opinions:
- Guillermo right: shipped incomprehensible, unmaintainable code with no security guarantees, no open-source value.
- Frees market from Next.js/Vercel lock-in, enables impossible use cases, freedom-amplifying.
Elon Musk podcast: hardest part of humanoid robots is hands. Nature 'vibecodes' via trial/error + natural selection (automated tests), layering DNA gunk into complex systems like hands/brain without understanding.
Life is vibecoded; only way to achieve impossible complexity.
Emulate evolution: LLMs mutate/search with automated tests for complexity beyond human hand-coding. Sloppy/risky, but benefits outweigh (like cars/airplanes).
Synthetic software: opaque block fitting a slot via tests; don't care inside.
Future: synthetic code everywhere, unstoppable.
Risky/slopy but enables new use cases. Third hand: the hands.
Is vibe coding temporary (revert on catastrophe) or accepted if benefits outweigh risks?
Keep Mo Bitar in your library
Save the videos and channels worth coming back to, and find them again in one place.
