Extensible Software in the age of LLMs
jeremymorrell.dev
August 19, 2026
25 min read
50/100
Summary
LLM-assisted coding can enable “software for one”: small, personalized applications and extensions that address users’ long-tail needs without forcing every feature into a product’s default interface. The proposed model for web applications combines a stable, accountable core with user-created code that can react to events, run on schedules, add views, transform data, and automate tasks. Potential uses include tailored AI agents, internal corporate tools, support-ticket workflows, and custom observability visualizations. Extensions could be generated from natural-language requests and shared with other users. Running user code inside web services requires low execution cost, fast cold starts, strict resource limits, tenant isolation, and controlled access to data and external actions. The author argues that narrow capability-based interfaces are safer than giving extensions API keys or unrestricted network access: code receives only specific approved functions or bindings, limiting data exposure and possible actions. Salesforce has operated a multi-tenant programmable platform since 2007 through its Apex language and event-driven customization model. The source identifies interpreters, V8 isolates, microVMs, and WebAssembly with WASI as possible execution technologies. It highlights Cloudflare Dynamic Workers as a production-oriented option, citing built-in observability, tenant-scoped storage, durable workflows, source control, and hosted LLM access. The author discloses employment at Cloudflare.
Key Takeaways
- LLM-assisted coding can let users create and share narrowly tailored extensions instead of requiring product developers to add every long-tail feature to a core interface.
- Safe web extension systems need isolation, resource controls, low-cost execution, and tightly scoped capabilities rather than exposed credentials or unrestricted network access.
- Salesforce has supported multi-tenant custom code since 2007 through Apex, custom endpoints, scheduled jobs, and application-event logic.
- V8 isolates, microVMs, embeddable interpreters, and WebAssembly with WASI are potential foundations for running untrusted extension code.
- Cloudflare Dynamic Workers provide execution on Cloudflare Workers along with observability, storage, durable workflows, source control, and access to hosted LLMs, according to the author.
What the discussion said
Commenters spent less time on the article’s branding and more on whether LLMs will turn software into endlessly adaptable personal tools. There is real evidence already: clients are arriving with AI-generated prototypes, and individuals are shipping tiny, tailored apps that beat bloated commercial alternatives for their own workflows. Several readers think conversational coding removes the prerequisite of years spent learning an IDE or programming language, making custom tools plausible even for nontechnical people. Others see web delivery as essential because personal apps are more useful when they follow users across devices and can be shared with family or small groups. The optimism is tempered by a blunt operational reality: an AI-made prototype is not a specification, and it often becomes valuable precisely where it stops being safely editable. Developers may increasingly be hired to infer the missing requirements, validate behavior, and rebuild a shaky proof of concept rather than simply patch it. Security drew the strongest technical caution. Sandboxes and object-capability designs can limit what generated code may access, but they do not save an app whose AI-written authorization rules expose shared data. Readers also doubt that most ordinary users want perpetual customization; reliable tools may remain preferable to malleable ones. The thread broadly likes capability-scoped infrastructure, but rejects the notion that generation alone eliminates product judgment, testing, and accountability.
Where opinion split
The sharpest dispute is whether AI makes extensible, personalized software a mass-market future or merely a niche for enthusiasts and professionals. Optimists argue that chat-driven creation makes customization as approachable as asking for a small workflow tool, while critics say most people want dependable finished products and will not manage mutable software. Both sides acknowledge that the hard boundary is not producing a first version, but safely evolving it when requirements, data sharing, and regressions appear.
Community Sentiment
Positives
- LLMs are already lowering the cost of bespoke software enough that people can replace bloated general-purpose products with small tools fitted tightly to one workflow.
- Conversational coding bypasses the usual barrier of mastering a language and development environment, widening personal-app creation beyond experienced programmers.
- Capability-scoped execution gives generated code only the narrowly defined powers it needs, a promising foundation for letting AI extend software without handing it every credential.
- Web-hosted personal apps can travel across phones and computers and be shared with close collaborators, making one-person AI-built tools more durable than local experiments.
Concerns
- AI-generated prototypes often become the handoff artifact when further changes start breaking existing behavior, leaving humans to recover the real requirements from a fragile implementation.
- A working proof of concept is not a complete specification; the missing edge cases and business rules are exactly why a developer is brought in afterward.
- Sandboxing generated code does not prevent data leaks when AI-written access-control logic is wrong, especially once apps expose endpoints and serve multiple users.
- The claim that everyone will want extensible software overestimates demand: many users may choose predictable, polished tools over systems they must continually reshape.
