Replit Bets That Software's Last Moat Is an Illusion

Amjad Masad wore a keffiyeh to a shooting range in Santa Clara last November. Two minutes with an AR-22, and the paper burglar's head was perforated. "I always compete," he told the SF Standard reporter riding shotgun in his black Mercedes.

Eight weeks later, Masad's company shipped a feature that turns competition into something closer to target practice. Replit's Mobile Apps feature, launched Thursday, lets anyone type a sentence and receive a publishable iOS application. No Xcode. No provisioning profiles. No developer account paperwork. Just intent, then app, then App Store submission. The friction that kept amateur software out of Apple's walled garden evaporated in a single product update.

"The barrier to creating a fully published, monetizable iOS application is no longer syntax or SDKs," Masad told CNBC. "It's just intent. You describe the vibe, and the AI handles the architecture."

You might read that and hear marketing fluff. But look at what Replit actually built. Stripe integration handles payments. The agent generates the interface. Apple reviews submissions within 24 hours, according to Apple's own data. A stock trader who wants an app tracking the top ten companies by market cap can now get one in minutes, not months.

The dissolving filter

Software companies have spent decades building moats around technical complexity. Learn Swift. Master UIKit. Understand memory management. Survive the Byzantine requirements of App Store Connect. Every step filtered out would-be competitors who lacked engineering resources.

Vibe coding dissolves that filter. That's the threat.

Replit isn't alone in this market. Cursor's parent company Anysphere hit a $29.3 billion valuation in November after raising $2.3 billion. Lovable, the Swedish competitor, sits at $6.6 billion. Claude Code, Anthropic's terminal-based coding tool, reached $1 billion in annualized revenue in six months. PitchBook tracked $4.7 billion flowing into AI coding companies in the last year alone.

But Replit's mobile announcement changes the geometry. Web apps are one thing. iOS apps that people pay for on their phones are something else entirely. The iShares Expanded Tech-Software Sector ETF has dropped 11% in three months as investors process the implications. Salesforce, Adobe, ServiceNow. All of them built businesses assuming that software requires software engineers.

You have probably built your own investment thesis on that assumption. Masad is betting his company that you're wrong.

The man with the empty calendar

Masad, 38, grew up in Amman, Jordan, drift racing on public streets and shooting guns in empty lots. Paul Graham's essays? He read them like scripture. Hacker News was his other addiction. The kid built his first version of Replit in 2010. Browser-based coding, back when programmers still bought software in shrink-wrapped boxes. Nobody else was doing that.

The Valley noticed. First Codecademy, then Facebook in 2013. YC let him in, and a16z wrote the check. Then came the validation that mattered most to Masad: Graham, the guy whose blog posts he'd memorized as a kid in Jordan, started thanking him in his own essays.

Then the company stalled. The education market turned out to be small. Enterprise sales sputtered. Late 2023: Replit killed its education product and cut 30 people, right after moving into a bigger office. Masad walked those empty halls feeling sick. "I felt like I let people down," he told the SF Standard.

But he'd been preparing for a different pivot. For years, Masad had preached on podcasts that AI would transform coding. Replit had quietly assembled an extensive database of coding materials, infrastructure that would take competitors years to replicate. He just needed the large language models to catch up.

They did. Replit launched its AI agent that September. End of 2024, the company was pulling in $10 million. Twelve months later? A hundred fifty million. Fifteen times over. Not a struggling startup anymore.

And then came October 7, 2023.

The price of having opinions

Masad has never been quiet about Palestine. After Hamas attacked Israel, he called out tech figures who supported what he described as genocide. The professional consequences arrived within days.

"My calendar was suddenly empty," he said. Party invitations stopped. Group chats filled with condemnation. One investor from a firm backing Replit publicly announced he'd donate any profits to the Israeli Defense Forces. Another investor called Masad's public persona "really challenging."

A startup Masad had invested in pitched a potential backer and got rejected because of the association. "He said, 'Oh, Amjad is investing. He's like a terrorist sympathizer. If he's investing, I'm not investing,'" Masad recalled.

If you're looking for the tell in this story, it's what happened next.

Saudi Arabia's Public Investment Fund invited Masad to a hunting lodge in South Africa. Thirty thousand acres of kudu and wildebeest during the day. Demos for Saudi officials at night. Masad showed his unreleased AI agent to Tareq Amin, now CEO of the Saudi AI company HUMAIN.

The deal closed. Replit became the exclusive AI coding software for Saudi governmental agencies. Masad expects "hundreds of millions" in revenue from the partnership.

Term sheets started arriving from the same VCs who had publicly distanced themselves. Atlassian signed. Zillow signed. Meta's in the mix, according to Masad. By the time the $250 million round closed, Replit was worth $3 billion. Money has a short memory.

Masad felt bold enough to post in September: "Today, the tide in tech has shifted. If you've been holding back, now is the time to speak out."

The security question nobody wants to answer

Replit's Thursday announcement contained one buried detail that deserves more attention than it received. A cybersecurity startup called Tenzai published a study finding that popular AI coding agents, including Replit and Claude Code, consistently ship apps with critical vulnerabilities. Password brute force attacks. Cyberattack vectors. Basic security failures.

The Technically newsletter tested Replit's agent against competitors and found something similar. Lovable's security advisor actually flagged that the database Lovable itself had configured had no security measures whatsoever. Any attacker could access user data.

If the model knows that's bad, the reviewer asked, why didn't it build the app correctly the first time?

Good question. No answer.

This is where the economics get dangerous. Professional developers aren't just writing code. They're thinking about edge cases, security surfaces, failure modes. They've been burned before. They know what SQL injection looks like and why input validation matters. A cheap app that leaks customer data isn't a bargain. It's a lawsuit waiting to happen.

If you type "build me a portfolio app," you won't know to ask whether the API keys are properly secured. You won't know to verify that user authentication can't be bypassed. You won't know that the app you're about to submit to Apple might expose customer data to anyone with a browser console. The friction Masad removed wasn't just bureaucracy. It was quality control.

The vibe handles the architecture. It doesn't handle the consequences.

What Masad actually built

Strip away the geopolitics and the personality, and Replit's bet becomes clearer. Masad isn't selling software. He's selling the absence of software people.

Not the absence of code. Code still gets written, just by machines that charge $6 for an initial build and $0.50 for bug fixes. But the humans who understood what that code was doing, who could evaluate its quality, who knew when something looked wrong. They're becoming optional.

The investor who called Masad "really challenging" still stayed invested. The Saudis didn't care about his Twitter posts. Meta wants to close a deal. What matters now is whether the product works, and Replit's revenue suggests it does.

Masad acknowledged the endgame over grilled venison at a Woodside restaurant. If Replit goes public, if he becomes a billionaire, he'll have capital to pursue the Palestinian cause that animated his mother's hopes for him.

"I just know that wealth is a prerequisite," he said.

He's not wrong about that. He might also be building something that will make wealth irrelevant for a lot of people who currently earn it by writing software.

The feature shipped Thursday. The App Store review takes 24 hours. The investor decks are already circulating for the next round.

And somewhere in Foster City, a guy who wears a keffiyeh to shooting ranges is betting that he can compete with anyone. He perforated the target in Santa Clara because he practices. Software engineering is just another target now, and Masad doesn't plan to miss.

Cursor's $29 Billion Bet on a Bottleneck It May Be Creating

Cursor acquires Graphite for code review. But research shows AI coding tools may create the bottleneck they claim to solve. The data is damning.

The Implicator

Vibe Coding Study: How Startups Outpace Big Tech

Anthropic study shows startups use AI coding tools 20% more than enterprises. 'Vibe coding' trend could create competitive advantages for early adopters.

The Implicator

Cursor ships faster agents while security researchers flag the gap

Cursor 2.0 ships 30-second AI coding agents while security research shows 45% of AI-generated code contains vulnerabilities. Speed meets risk.

The Implicator

Marcus Schuler

San Francisco

Editor-in-Chief and founder of Implicator.ai. Former ARD correspondent and senior broadcast journalist with 10+ years covering tech. Writes daily briefings on policy and market developments. Based in San Francisco. E-mail: [email protected]