23 minutes — that's how long it took DDoS to flatten a website an AI wrote in 30. This isn't a punchline; it's something enterprise IT should stop and read. Using Vibe Coding (letting AI write code on instinct while barely typing a line yourself), the developer built a community rating site called 锐评. To lower the barrier to entry, they opened visitor rating and commenting. Within tens of minutes of launch, two adjacent IP ranges hammered the detail pages with roughly 200,000 requests and dumped nearly 3,000 minimum scores. After attackers' IPs were banned, they switched accounts and posted 128 gibberish comments. When the developer tried to close visitor permissions, they couldn't even reach the backend — they had to edit the database directly and ultimately shut the site down.
What This Is
It all happened overnight: posted on 2Libra at 20:50, on V2EX at 21:01, first suspicious request at 21:12:53 (the path matched the V2EX post's unique link), high-frequency attack began at 21:24 with peaks near 2,000 requests per minute, mostly over by 22:05. Vercel's DDoS Challenge blocked roughly 164,000 requests, but over 50,000 still got through. Afterward, the developer added email verification, Attack Mode, site-wide rate limits, and per-user, per-target daily action caps before 锐评 could come back online.
The developer's own post-mortem delivered the line that matters most: "Production-grade products aren't something AI can ship in a few clicks."
What the Industry Thinks
The optimists will say: this proves AI's productivity — a solo developer shipping a complete product in 30 minutes was unthinkable before. Vibe Coding has smashed the 0-to-1 barrier to the floor.
But the cautionary counterpoint deserves more airtime. Every trap the developer fell into — open visitor permissions, disabled email verification, no endpoint rate limiting, no pre-emptive attack-surface review — is a product judgment that only surfaces after launch. No matter how fast AI writes code, it won't make those calls for you. In other words, AI compresses 0-to-1 into 30 minutes, but no tool today can skip the 1-to-production-ready step.
We also notice an overlooked side effect: as "AI-built product in three minutes" becomes universally accessible, the internet accumulates more cheap targets. In the past, no one noticed a personal site; now these toy sites are everywhere, and each one is a potential attack entry point. This time Vercel caught the fall. The next project without a safety net may not even have time to export its logs.
Impact on Regular People
For enterprise IT: "Internal tools built by employees using AI" will keep multiplying. Security teams need to fold them into the asset inventory rather than assume the intranet is safe.
For individual careers: The premium on "knowing how to use AI to write code" is fading. The new premium sits with people who can spot where their own work has holes — where it can be gamed.
For the consumer market: Expect more small, pretty-looking tool sites to suddenly disappear or break. It's rarely the design that's wrong; it's that the author didn't survive their first taste of the real internet.