Bugbot Is Here — And It Completes the Self-Healing Loop That Vibe Coding Was Missing

Let me tell you about the morning I quietly typed “Bugbot is finally here” into Slack.

For the past two months, I’ve been writing about vibe coding as a dangerous toy. The thread started in March with a WIRED investigation that found serious RLS (Row-Level Security) flaws in 10.3% of apps built with Lovable — 1,645 apps examined. In May, I followed up by cataloguing “works but broken” examples across five major AI coding tools. That week I also received a flood of reader messages asking the same question: “So how do I actually protect myself in production?”

On May 13, 2026, WIRED.jp broke the news that Cursor had announced “Bugbot” — an AI that reviews and fixes code written by another AI. It sounds understated when you put it that way, but to me this was the final piece of the vibe coding “resolution arc” clicking into place.

What made it even more striking: the day before, I had just published a piece on Cursor the company, analyzing why Fortune described them as standing “at a crossroads.” One week after the crossroads article, Cursor itself provided one of the answers. That kind of timing demands a write-up.

---

The Day After “At a Crossroads,” Cursor Answered

In my previous article (Why Fortune called the “fastest B2B SaaS ever” a company at a crossroads), I unpacked the Fortune analysis. A company that hit roughly $200B ARR in three years, yet landed a headline reading “at a crossroads.” The reason was simple: if Cursor stayed a “code-writing tool and nothing more,” Claude Code and Codex might eventually swallow it whole.

While writing that piece, I half-expected what would come next. Cursor would probably stop betting solely on the writing side.

The next day, WIRED.jp ran: “Cursor announces Bugbot — AI that automatically detects and fixes AI-written code.” I nearly spilled my coffee. From a tool that writes to a tool that writes and fixes. The shortest possible corporate answer to the weakness Fortune had identified.

One thing worth underlining: this is bigger than Bugbot as a feature. Cursor is repositioning itself — repainting “crossroads” as “the starting point for a self-healing loop.” The weight of that announcement isn’t captured in any feature list. It compresses down to a single line: the battleground of the industry just shifted.

I’m a recovering failed engineer. Cursor rescued me; Claude Code fully reignited my desire to build. So I feel viscerally how significant this is. Vibe coding has finally reached the stage where the tools themselves begin to answer the question: “It runs — but is it actually okay?”

One caveat upfront: Bugbot is not magic. In the second half of this piece, I’ll work through five common misconceptions and explain why professional code reviewers are not going anywhere. Getting expectations calibrated now matters — because the last thing we need is a relapse into the “if it runs, ship it” trap.

---

What Is Bugbot? — The Moment “Writing” and “Reviewing” Split

Bugbot is Cursor’s AI-powered code review feature, announced on May 13, 2026. According to the WIRED.jp report, it automatically leaves comments on Pull Requests (PRs — the unit of proposed code changes in collaborative development), flagging potential bugs, type errors, and security concerns. Architecturally, it occupies a position similar to existing CI (Continuous Integration) tools.

The key point is that Cursor has for the first time separated “the AI that writes code” from “the AI that reviews code.” Until now, Cursor was all-in on writing assistance. Whether the written code was actually correct fell to the human — you ran it locally and checked. That was my workflow too.

“Why not just have the same AI write and review simultaneously?” That was my first thought too. But here’s the thing: if you ask the same AI to write and then review, it can only reason from its own assumptions. It’s like grading your own exam. That’s precisely why assigning a separate AI to a separate role has real value.

What struck me as genuinely well-thought-out: Cursor placed Bugbot at the Pull Request layer. A PR is the last checkpoint before code reaches production. Putting an AI reviewer there permanently is a design choice that signals Cursor has accepted the professional consensus that code review is a non-optional step.

Vibe coding’s speed-above-all culture has now internalized a pause-and-check phase. That, to me, is the actual headline.

Bugbot’s supported languages, repository formats, and pricing (free tier vs. paid add-on) were not specified in the WIRED.jp breaking news. I’ll update this post when Cursor’s official release notes come out. My current guess is TypeScript, Python, Go, and Rust for initial support — but that’s speculation based on early reporting only.

---

Why This Is a Turning Point — Revisiting Three Incidents from March to May

I want to call this a turning point because the Bugbot announcement only fully lands when you line it up against three incidents over the past two months. Each looks like a separate story; together they form a single arc.

Incident 1: March — 170 Backdoors in Lovable Apps

The first shock was the story I covered in March: 170 backdoors in vibe-coded apps. WIRED audited 1,645 Lovable-built apps and found serious RLS flaws in 10.3% of them. In plain terms: User A’s private data was openly readable by User B.

Why does this happen? When you ask an AI to “build me a SaaS with login,” the AI writes the shortest working code path. It creates the Supabase tables, wires up authentication, stores the data. The step of configuring “other users can’t see this data” isn’t something the AI adds on its own. Unless you explicitly ask for it, the table ships in its default open state.

This is vibe coding’s “works but broken” failure mode, version one.

Incident 2: May — Production DB Deletion

Then in May, the story I covered in Design Before It Breaks: a developer who had Cursor delete their production database. They asked the AI to “clean up unnecessary tables.” The AI executed DROP TABLE without distinguishing between production and staging environments. The data was eventually recovered, but the developer wrote that they couldn’t sleep that night.

Different incident from the RLS story, same root cause. AI-assisted “just make it work” code crossed a guard that should never have been crossable. Forrester responded to this category of problem by coining the term “Secure Vibe Coding.”

Incident 3: May 13 — Bugbot Announced

And now Bugbot. After two months of “AI-written code is dangerous,” a tool vendor has effectively admitted: “The writing AI alone isn’t enough — we need a separate AI dedicated to reviewing.”

I frame these three as problem → diagnosis → prescription. Vibe coding spread widely, damage cases were observed, and the industry issued a treatment plan. It’s almost textbook clean. That’s why Bugbot isn’t a one-off announcement — it’s the series finale.

---

How to Use It — “It Runs” Becomes “It Runs, Gets Verified, and Ships”

I haven’t been able to test the official Bugbot release in my own environment yet, so what follows is a projected look at how my development workflow would change once it’s available. I’ll update with hands-on findings when I get access.

Before (My Current Dev Workflow)

# 1. Write code in Cursor (vibe mode)
# Ask the AI: "Build me a ToDo app with user authentication"

# 2. Run locally and check
npm run dev
# → Works. Great.

# 3. git push
git add .
git commit -m "feat: add user auth ToDo"
git push origin main

# 4. Deploy to home server
# → Works. Done.

The problem with this flow is how easy it is to conflate “it works” with “it’s correct.” I myself had a Supabase portfolio project deployed publicly without row-level security configured — until I read about the March Lovable incident. Looking back, that’s unsettling.

After (Projected Flow with Bugbot)

# 1. Write code in Cursor
# (this part doesn't change)

# 2. Run locally and check
npm run dev

# 3. Cut a branch and push
git checkout -b feature/user-auth
git push origin feature/user-auth

# 4. Open a Pull Request
# Bugbot automatically posts review comments
# Example: "Possible missing RLS policy on supabase.from('todos').select()"

# 5. Read the feedback, fix if needed
# 6. Human reviews and merges

What changed: an AI verification step now sits between “it runs” and “it’s merged.” That seemingly minor gap is exactly where accidents kept slipping through.

A note I’ll share now to save you three hours: until I can verify Bugbot’s real behavior firsthand, I’m keeping Snyk and semgrep running in parallel in my CI pipeline. AI review is a “smart colleague,” not an “all-knowing guardian.”

---

Will Bugbot Replace Professional Code Reviewers?

“Does this mean we don’t need professional reviewers anymore?” — I’ve already heard this from three different people. As someone who came up through customer success before moving into media, this is a question I want to answer carefully.

Professional reviewers aren’t disappearing. Their role is shifting. Let me clear up five common misconceptions.

Misconception 1: AI will catch all type errors and security holes

Not accurate. AI review excels at pattern-matching detectable bugs — classic null references, common SQL injection patterns, unused variables. But business logic inconsistencies and domain-specific constraint violations are invisible to it. “This user is an admin, but this particular action is still off-limits” — that kind of judgment requires a human who understands the business domain.

Misconception 2: If you have Bugbot, you don’t need CI

You still need CI. Bugbot handles semantic, AI-driven review. CI handles mechanical test execution and type checking. They operate at different layers. In my own workflow, I’ll keep running lint and tests via GitHub Actions before the Bugbot PR review step. Having both reduces what slips through.

Misconception 3: Human reviewers just get more free time

This one’s more nuanced. Yes, trivial tasks like typo-catching will decline. But human reviewers will be pushed to focus on higher-order design decisions instead. “Easier” isn’t guaranteed. Reviewers who relied on catching typos to add value will face pressure.

Misconception 4: Bugbot is better than Claude Code

They’re different things. Claude Code is a CLI agent for writing and editing code. Bugbot is a PR review agent. They’re not competing — they’re complementary. As I wrote in my Cursor company analysis, Cursor chose to move beyond being a one-trick “writing tool.” Claude Code is doubling down on the writing side. The two coexist.

Misconception 5: Bugbot makes Secure Vibe Coding unnecessary

The opposite is true. Bugbot automates the last checkpoint — it doesn’t eliminate the need for quality at the design stage. Secure Vibe Coding, the preventive design philosophy Forrester proposed, becomes more effective with Bugbot, not less. I’ve been pushing this approach since March. Even with Bugbot in place, not generating dangerous code in the first place is still faster end-to-end.

---

For Those Just Starting Out — The Final Piece for Recovering Failed Engineers

If you’ve read this far, there’s probably someone thinking: “I’ve never written code before — is this actually a world I can enter?” CS team members have asked me this many times.

My answer: right now is the most accessible entry point in the past two years.

Three reasons.

First, the writing-side tools — Cursor, Claude Code, Copilot — have matured. The speed and quality of AI-written code today is categorically different from 2024. Three months ago I asked current Cursor to rewrite a spreadsheet automation bot I’d built: it came back 30% shorter and more secure.

Second, the verification-side tools, including Bugbot, are finally coming together. This is huge. “Works but broken” code can now be caught by AI even when humans miss it. For recovering failed engineers, this is a psychological safety net.

Third, the body of case studies. The March Lovable incident, the May Cursor production deletion — tragic incidents, but as teaching material they’re invaluable. “Read about someone else’s accident, avoid the same hole yourself” — this style of learning became dramatically easier over the past two months.

I once sat next to a colleague who wrote code I thought I could never reach, silently swallowing the frustration before eventually shifting my career into customer success. Looking back: I’m genuinely glad I didn’t give up on coding. Hold on long enough, and powerful allies show up in your hands. “Vibe coding” might not be the right label for everyone. That’s fine — the name doesn’t matter. Using AI to make your own work easier, on your own terms. The threshold for that has never been lower than it is today.

I’m planning to call the Cursor + Claude Code + Bugbot combination “the recovering engineer’s comeback kit.” The third piece finally arrived.

Write. Get It Reviewed. Ship.

My honest hope is that you read this not as a Bugbot feature explainer, but as a three-incident arc spanning three months.

• In March, 170 backdoors were found in Lovable apps, forcing vibe coding to confront the “works but broken” problem.
• In May, the Cursor production DB deletion incident was reported, and Forrester coined “Secure Vibe Coding” as the prescription.
• And on May 13, Cursor announced Bugbot — separating the “writing AI” from the “reviewing AI” and setting a self-healing loop in motion.

The “if it runs, ship it” era is over. The new standard is “it runs, gets verified, and ships.” It looks like a quiet change on the surface. But I want to mark this as the day the industry’s battleground shifted.

I’m genuinely glad that Cursor turned its “crossroads” into a “starting point.” The tool that recovering failed engineers leaned on is evolving in the right direction. Glad I didn’t give up. That’s enough for today.

One request to you, the reader: when Bugbot runs in your environment for the first time, share what it feels like — with the hashtag #VibecodingResolved if you’re up for it. I’d like to widen the circle of recovering engineers finding their footing again.

---

Sources

• WIRED.jp, “Cursor announces Bugbot — AI that automatically detects and fixes AI-written code” (breaking news, 2026-05-13)
• Fortune, “Cursor at a crossroads” (source details in my Cursor company analysis)
• WIRED, Lovable app audit: serious RLS flaws in 10.3% of 1,645 apps reviewed (source details in my Lovable vulnerability article)
• Forrester, “Secure Vibe Coding” framework (source details in my Secure Vibe Coding article)
• Cursor official blog, “Introducing Bugbot” (details unconfirmed as of breaking news)
• Cursor official documentation (supported languages and details unconfirmed as of breaking news)