Building In-House With AI (Cursor, Claude Code, Lovable, v0) vs Hiring an Agency

These are the four tools most first-time builders reach for, and they split into two camps. Cursor and Claude Code are AI coding assistants that live inside a real code editor — they read your existing codebase, write and refactor code, and run commands, but assume someone can read what comes out. Lovable and v0 are prompt-to-app builders: you describe an app in plain English and get a working, deployable front end (and some back end) in minutes.

For getting from zero to “look, it works,” they are genuinely powerful. A non-engineer can ship something clickable the same afternoon, and a developer can move several times faster on boilerplate. This is the practice Andrej Karpathy named “vibe coding” in February 2025 — describing intent and accepting AI-generated code with minimal review — which Collins Dictionary later made its 2025 Word of the Year.

The demo is not the product. AI compresses the visible, generative ~70% of a build; the remaining 30% is architecture, security, error handling, edge cases, performance under real load, and being accountable when something breaks. That slice is exactly where these tools still fall short — and it is most of what a paying user actually depends on.

The risk is concrete, not hypothetical. Veracode’s 2025 GenAI Code Security Report found roughly 45% of AI-generated code samples failed security tests. In May 2025, security researchers reported that 170 of 1,645 apps built with the vibe-coding tool Lovable exposed personal data (CVE-2025-48757). And code you didn’t write is code you can’t easily fix: GitClear’s 2025 analysis found AI-assisted work raises duplication and lowers refactoring — the signature of a codebase getting harder to change.

Reach for the tools alone — and skip hiring anyone — when the stakes are low and the lifespan is short. If you are validating an idea, building an internal tool, making a prototype to show investors or users, or testing whether people even want the thing, an AI-built MVP is often the right, cheapest answer. Around a quarter of Y Combinator’s Winter 2025 batch had codebases that were ~95% AI-written, and for early validation that is fine.

Be honest about the exit criteria, though: “it demos” is the goal here, not “it withstands real users.” The moment the same prototype starts taking real payments or storing customer data, the calculus flips — and the cheap MVP quietly becomes a liability you now have to rebuild.

Bring in an agency — a team that ships production software end to end, covering design, engineering, QA and DevOps — when the cost of getting it wrong is real. That means anything with real users, payments, authentication, sensitive or regulated data, uptime expectations, or a life measured in years rather than weeks. These are the parts AI won’t own for you, and the parts a freelancer may not stay around to support.

A good agency is also worth it when you simply can’t be the technical owner yourself. If you can’t review the code, judge the architecture, or be on the hook at 2 a.m., you need accountable engineers — not more prompts. If you can do those things and the surface area is small, you may not need us; that is a legitimate outcome.

Yes — and it is one of the most common ways teams engage us now. The usual path is a short audit of what the AI produced, a decision on what to keep versus rebuild, and then hardening the risky 30%: security, data model, tests, and the architecture that has to scale. Well-structured generated code can often be extended; tangled or insecure code is faster to rebuild than to untangle.

The practical move is to plan for this from day one. Prototype fast with AI to prove demand, then budget a production phase with a senior team before you scale — not after something breaks. That sequencing gets you the speed of AI and the durability of real engineering, without paying for a rebuild you could have scoped up front.