asked the agent to make them for me, right? Um, and every app in this platform automatically integrates with agents so that you can do that. And so what I did is I gave Claude a link to this document, this Google doc where I had described all of the gadgets that I wanted or all the the slides that I wanted in my um in my presentation. And crucially though, this is the interesting point. I said, if you need uh if you need to add any new features to the slides app itself to support some of these slides, feel free to do so. And it did. Um Claude read all the code for the app and read my doc and said, "Yes, actually, let's see. Slide three needs a uh strikethrough formatting. That's not implemented." Um we can add that. Um, some of the slides require things to be centered. And you know, I guess Philip's design taste is too good for centering text. Uh, but my more pedestrian taste called for some centering. And that's okay. Cloud can add that. Um, more interestingly, slides uh five and six here. So, I asked for this like really crappy diagram of the cloud, right? And the the app um didn't support sort of like arbitrary diagrams. It supported, you know, uh box diagrams and arrows and such, but not an arbitrary drawing like this. And so Claude said, "Okay, that's okay. We can add a feature. We'll add a feature that allows uh you to insert a bunch of SVG. Just paste it into this box here. And now it becomes uh part of the slide." And now that's not very useful for any human, but it was perfectly useful for Claude who then generated the SVG. Now, at this point, you might be looking at this and saying, "That's a little scary. SVG can contain JavaScript. Uh, are there XSS bugs here?" And the answer to that is, uh, it doesn't really matter because of the way this environment is set up. So the UI that you see for the app here is running inside a null origin iframe sandbox um with content security policy set so that it basically cannot talk to anything any of the rest of the world can't access any cookies so on um the only thing it can do is post message to the parent frame and through that post message channel we set up a a captain web RPC uh session which forwards onto the server and all the way back to the server code for this gadget which is uh this code here which is written as a a durable object on Cloudflare workers and uh basically that means so so this this server code runs in a dynamic worker sandbox uh on the server side where it too is prevented from talking to any of the rest of the world. So now we've set up this environment where there's a vibecoded client and a vibecoded server. They can only talk to each other and produce the UI uh for the user. And so if you have an XSS bug, it actually doesn't end up mattering because these can't leak anything. Um they're prevented from doing so. And it basically there is no security bug you can have in this code that matters. Um,