Last month, a critical WordPress vulnerability triggered emergency patching across the web and reignited a familiar argument: if WordPress keeps having security issues, why not let AI build something new instead?
It's a reasonable question.
It's also the wrong one.
The real question isn't whether AI can build software faster. It can. The real question is who's going to maintain that software after launch.
That's not an abstract debate. It's the exact argument playing out on LinkedIn right now and in agency sales pitches. One recent post argues that WordPress "no longer makes sense" in the AI era. A competing CMS vendor describes it as little more than a relic of 2003-era web publishing. Another agency touts a static-site-plus-AI approach that cut tooling costs by 60-70%. Different conclusions, same premise: mature CMS platforms are becoming unnecessary because AI makes custom software cheap.
WordPress runs on code that gets looked at, tested, and patched by a global community, thousands of developers deep, every single week. When you leave it for something an AI built from scratch, that code has exactly one maintainer: you. And "you" usually means whoever happens to be available, not whoever originally wrote it.
That's the part a growing wave of "AI instead of WordPress" pitches tends to leave out. The cost of creating software is falling fast. The cost of maintaining it isn't.
None of that math counts the maintainers you're giving up, or what happens after launch. A friend of mine - not a developer, just someone who wanted a small tool for other artists to use - started vibe-coding an app a few months back. When I checked in this week, he still hadn't shipped it. Not stuck exactly, just quietly moved to the back burner: it was deceptively easy to get something working at first, but the list of details he needed to handle to get from "working demo" to something he'd trust in production kept growing - details a mature open source project already worked out years ago, for everyone, for free. That's not a knock on him, or on AI tools - it's just what the data shows happening at every scale, from a side project to a funded startup.
We already have a real-world example of an "AI" provider leaving clients stranded. Builder.ai spent years promising organizations AI-built custom software - and then collapsed in 2025, leaving clients locked out of tools they had paid to have built, with no other vendor who understood the custom architecture well enough to pick it up.
Builder.ai was more a symptom of the hype around AI, and a cautionary tale. From a security standpoint, there are plenty of problems with neglected softfware. All of these represent risk to your business, depending on what you're running:
- abandoned WordPress plugins
- abandoned Drupal modules
- abandoned npm packages
- abandoned SaaS products
- abandoned internal business applications
-- if nobody maintains a chunk of software in use, it can become a liability, more "surface area" for an attacker to probe. If AI now gives you the ability to generate a lot more software a lot more quickly -- why won't that just create a bigger problem for you in 18 months, when you've long forgotten what you've built?
Build time is shrinking faster than maintenance time.
The problem is that software isn't expensive because it's hard to create. It's expensive because somebody has to maintain it.
And it's not just us pointing this out. A WordPress developer with twenty years in the ecosystem wrote a direct rebuttal to this exact wave of "we're moving everything to AI" posts, describing what's actually happening to the clients of the agencies making the switch: they've traded a well-understood maintenance burden for a poorly-understood one. Same conclusion, arrived at independently, from someone who's watched this industry long enough to recognize the pattern.
Still, the case the hype is built on is real. We patched the critical WordPress vulnerability across every client site in under four hours -- the kind of thing we do quietly, all the time, that's genuinely worth mentioning once in a while.
In the same LinkedIn feed, WordPress consultant Jean Galea posted stats pulled straight from WordPress.org: 39% of WordPress sites aren't on the current version. Around 8% are still on a release from several years back. 28% are running end-of-life PHP that gets zero security patches, no matter what's discovered against it.
His conclusion, and ours: almost none of that is a WordPress problem. It's a maintenance problem. The patches exist. The work is to apply them, and that's exactly the work that gets skipped once a site is "done" and nobody's watching it anymore.
The solution isn't "create a bunch more software." It's engineering discipline: testing, documentation, monitoring, patching, incident response, and the boring maintenance work that keeps systems healthy long after launch.
AI can help with that. We use it every day to write tests, generate documentation, review code, and automate parts of the maintenance process. Used well, it can make engineering teams more effective and help enforce practices that often get skipped when budgets get tight.
What AI doesn't do is make maintenance disappear. It just changes how the work gets done.
Add new comment