DEV Community: Ruben Arevalo

What I Built By 25

Ruben Arevalo — Mon, 10 Aug 2026 13:21:42 +0000

I'd Been Building By 22

I turned 25 today, on August 10th.

By 22, I had already built software for 6 years before making the pivot to implementing AI through the Headstarter program, which I participated in from July 2024 to September 2024. During that same period, I built IncludiTrip, an itinerary generator that provides recommendations for people with disabilities, along with information for accessibillity resources they can use. I also built RateTeach AI, a chatbot that relies on an external database of information to tailor its responses to specific questions a user asks.

In late 2025, I started building the prototype for JALE (Job Automation & Logistics Engine), which originally started as a content management system meant to make updating my website content, such as my education and work experience, easier without having to go into the codebase and manually making the changes myself. Eventually, in early 2026, I decided to shift my prototype CMS into one that would focus entirely on project management, along with integrating AI that will measure a user's performance, in addition to tracking inconsistencies in their amount of hours worked.

Founding The Studio With Nothing

This same year, at the age of 24, I founded Ruben Arevalo AI & Software Studio. Now, before I elaborate further, I want to admit something honest, and it's something that those who have been reading my articles should take into account, especially those who are starting their first business venture. None of it was funded, and I had no clientele to begin with. In startup culture, it is often expected for first time founders to have a huge budget and a team of brilliant individuals to help them carry out their vision. For me, I deviated from every single one of those norms. Why?

Why I Deviated from Every Startup Norm

The reason comes down to two main points. One, I already knew what I wanted. I want to build AI that revolves around human-in-the-loop practices (read the article here). Sure, there are AI tools out there that have the same concept implemented, but it's not built in the way I want to build it. My vision is responsible AI that can eventually do the work confidently on its own, while remaining compliant with regulations set by the state and hopefully, in the future, by the federal government. For instance, if it's going to analyze confidential information, such as payroll data, the person in charge of doing the payroll should decide whether to let the AI do their work for them, or deny the request and have it just save the spreadsheet for them to manually analyze the data.

Two, there is a real risk and danger that startups fail. As of August 2026, in an article published by Om Patel, the founder of BigIdeasDB, the three most common reasons why they fail as cited across their acquisition-listing data are attention collapse (a founder loses interest and/or something else pulls them towards that direction, which causes the product to decay over time), unmeasured retention (failing to account for whether customers actually stay and continue using the product), and customer concentration (only few customers that pay, where losing even one of them can result in significant revenue loss).

As valid as these reasons are, there are other ways where a startup can fail. Based on findings from an August 2011 report by Startup Genome, 74% of startups fail as a result of scaling early when the foundations don't exist yet, otherwise known as premature scaling. This also applies to hiring, spending, or expanding before the business has an opportunity to scale properly in the first place. Despite the report being 15 years old at the time of writing this piece, the same idea still applies: if startups scale sooner than expected, there is a high likelihood that they'll fail, either through poor planning, timing, a lack of resources, or a combination of the three.

It's very easy to fall in those traps, given that ambition usually plays a role in wanting to scale right away, when in reality, it's far from necessary. If you build alone and lose focus of your vision, so does your product's visibility. If you scale or build too fast, it's premature scaling, plain and simple. Both are traps that I have to avoid.

Where My Studio Currently Stands

How does this present itself in the actual progress and stage of my studio? Let me break it down:

I never secured funding, nor did I hire people to help me out: In the early stages, I didn't have the network or the budget to bring people in. Instead, I relied on what I knew, did my own research on how to scale properly, and decided when it was time to announce products that are in the works, such as JALE and BENNY. It wasn't because I didn't trust outside perspective; I simply didn't have access to it. I had to make the calls myself, even the ones that I wasn't entirely sure about but had to make a leap of faith regardless. That's starting to change. As the studio grows, I am now thinking about who to bring in next, because I want to give right kind of people the opportunity to be part of a magnificent project that will positively impact businesses and individuals for years to come, not just an opportunity to list on a resume.
BENNY on alpha: Early this month, I decided to release BENNY on alpha, four days before I turned 25. Currently, it's not finished, and I won't pretend it is. As I stated in one of my previous articles, BENNY is not an AI agent yet in the sense that it lacks the autonomy to perform tasks confidently to the best of its ability, only consisting of if-else statements at the moment. I built the prototype using the same process as I am currently doing with JALE: no funding, no team, and testing it against real scenarios before actually announcing that it's ready to go. For those who are not familiar, alpha means that the version is still a prototype that can break, and feedback is critical for this part of the process to further improve it before transitioning it to beta. That's exactly what BENNY states: "Be patient with me as I'm learning 😀"

The cost of working solo: While working alone has allowed me to gain deeper insights into my work, I also learned where my limits truly lie. I'd be lying if I said I never experienced stress. As any other startup founder, working solo has opened me to a risk of burnout. Based on findings from an analysis by Sifted in February 2025, 54% of startup founders have experienced burnout in the past year, with 46% saying that their mental health has taken a turn for the worse, and 75% saying they experienced anxiety in the same period. I had nights where I was beginning to doubt whether the articles I've been writing, from TRAIGA to discussing about SEO, GEO, and AIO, have been worth the stress. I was also sometimes questioning whether JALE would evolve into something more than a prototype. Regardless, I keep going knowing full well that it takes time to build these products, and that patience is key to a high-quality one.

I have turned 25. I have no funding, no team (yet), a prototype that can break at any moment, and a studio I built from scratch. I wouldn't trade anything else for it. But I always follow the same philosophy: research, analyze, know when to act, share with anyone interested in my work, and always stay in the loop about current events, especially when it comes to software development and AI.

What's Next

I want to share for those reading: you don't need to join or apply for a Y Combinator startup when in reality, you can build something of your own without needing outside funding or a team unless you are ready. Make your own resources and share them; don't restrict them.

The next few months will be some of, if not, the most important of my career, and once I've made my decisions, there is no turning back. There's work to do, but I am always ready for a challenge.

GEO Is Not About SEO Points. It's About Proving You're Real.

Ruben Arevalo — Sat, 01 Aug 2026 19:50:10 +0000

Why #1 In The Search Rankings Is Not Enough Anymore

SEO has evolved over the years, and with AI now answering questions for people in various search engines, business owners are now wondering more than ever on what actually makes them more visible. It's not about adding more keywords or being ranked higher. It's about whether an AI model can verify you're real and whether the content you provide is verifiable and helpful. The ones that get cited are the ones that are.

According to an analysis performed by Semrush in September 2025 for over 69M+ Google AI Mode search sessions, 93% of the links provided in the results within the session are not clicked by the end of it. Only 6% to 8% of the links provided during an average AI Mode session are.

Because few searches end up in a click, business owners who want to stay visible and relevant are now left wondering what the best strategy is. The first instinct that comes to mind is to immediately assume that by adding more competitive keywords, they can rank higher in search engines such as Bing, Google, and Yahoo, which has been the norm in the last two decades for search engine optimization (SEO).

But the question they should really be asking themselves is: how helpful can my content actually be to the person, or to the AI, processing it?

Why 27 Thin Content Pages Almost Cost My Presence

I was in a similar situation recently while I was working on the 27 pages that I built for my site. To ensure that my readers understand what I am referring to, especially those who are not familiar with the technical terms, I implemented a concept that generated dynamic pages using a template. Unfortunately, most of the same template text and context was reused across all 27 pages for my services and the cities I service them to. This caused the search engines to flag it for thin content (where there is very little content and/or context to work with) and duplicate content, which is a broader definition for content that is too similar or exactly the same as the other page(s).

Last week, I went ahead and took down the code that was responsible for generating the dynamic content from a file I wrote the content into, realizing that it was never going to be scalable long-term. I ultimately decided to use the CMS (content management system) editor within my software, J.A.L.E. (Job Automation & Logistics Engine), which I previously mentioned in an article discussing whether we are giving up our autonomy to an agentic AI.

Using my experience with SEO, something I've learned and applied while working on the original version of my site, a portfolio showcasing my education, experience, and projects, I manually rebuilt the 27 pages, utilizing the research I did online regarding GEO (generative engine optimization) and AIO (AI Optimization).

GEO allowed me to optimize the content so that AI search engines, such as Google's AI Overview, as well as Bing's Generative Search, can display the results of my site whenever someone, myself included, researches my background, as well as the services I offer, in addition to the articles I've been pushing out from my studio's blog since June 2026.

How can this be applied for businesses looking to stay ahead in the search results to attract more customers and leads?

Three Questions Businesses Must Ask Themselves And Answer

A business looking to take this approach must ask themselves these three very important questions:

How verifiable is my business?
Who else, besides myself, can vouch for my work and speak greatly about it?
How helpful is the information on my site and what lasting impression would it leave on my customers, regardless of whether they search it themselves or an AI recommends it to them?

SEOLocal heavily emphasizes this in an article they wrote in July 2026. Currently, only 1 to 3 businesses get named in a normal AI response, and 88% of Google AI Overviews cite three or more sources to support their claims depending on the user's input. SEOLocal also states that in order to get recommended by an AI search engine, such as ChatGPT or Google's own AI Overview, there are four criteria that can help your business be listed on top:

Content that is formatted to answer questions for visitors: this includes asking how much the service costs, what makes the business different from others, etc. Customers love to hear these questions answered as it plays heavily into their decision to utilize your business' services.
Schema markup: this is the more technical part of SEO that few understand, but I will break it down for people who don't understand or have an idea of what it is. Basically, a schema markup is like a graph containing information, which consists of your business credentials, the services you offer, the area(s) you serve, etc. Google and other search engines utilize this information to tailor users' preferences, depending on what they are looking for.
Consistency in branding: Your presence is not just limited to your website. Search engines always cross reference the information found online, and to ensure the best results and a higher likelihood of your business being in the top results, consistency is key. That means that even the smallest deviation in your Google Business Profile or social media profiles will cause the search engine to not trust the different signals that they're giving out, even though they are part of the same brand.
An established digital footprint: While social media helps your business get promoted in addition to the content your website provides, it's not enough. Business reviews, especially positive ones, along with mentions by customers and members of your industry, play a crucial role in the long-term outcome of your business. But search engines don't just analyze the words in the reviews themselves; they also consider context, which is especially crucial if you want to top off the other dozens of competitors in your area that run the same type of business you do. While the number varies, it gives you a rough idea of the work that has to be done to retain and improve your reputation amongst your customer base and the wider industry.

For those who don't understand, let me put it in plain English: make sure your content is easy to understand and answers your customer's questions, be straight on the areas you serve and what services you offer, make sure your website and social media are saying the same thing, and most importantly, make sure people comment on and vouch for your work, not just your marketing strategy.

AI Does Not Vouch for You or Your Work.

This leads to the crux of the matter: AI is not destroying your business. Instead, it's a result of the improvements it has undergone over the past few years, evolving into a mechanism that verifies both the text and context of the content you provide.

An article written by Entrepreneur on July 31, 2026, based on research across 400 business owners in five industries, reveals that businesses where both the owner and their brand were visible to AI saw a 2.5% year-over-year traffic increase. The same research also found that 46% of business owners are not visible to AI, and business owners who had neither their brand nor themselves visible saw a 28% drop in traffic. In other words, if any of the 400 business owners belonging to the 46% category entered a prompt on ChatGPT asking for a recommendation on the best businesses in the area, they would get a result that does not include their business.

There was nothing to lose. Except the lack of presence.

Normally, it would be really tempting to call this entire situation unfair. But blaming a machine or an algorithm won't help you build what you never built in the first place: presence. If there was no founder or context to begin with, especially on your website, then you never had anything to lose.

Why I Rebuilt My Presence

This is why, at the very beginning, I had to decide whether to let my site fade away or do something about it to make my presence known, even if it meant starting from scratch. That is why when I upgraded my site in October 2024, I knew I had to make my own face visible, while also providing context on who I was, where I went to school, what projects I did on the side, etc.

With the rise of my studio, Ruben Arevalo AI & Software Studio, I had to significantly change my content to ensure that it aligned with the latest SEO practices, as well as implement GEO and AIO concepts, concepts I'd never heard of until this year. That was also the case when I decided to reconstruct the 27 pages through my software, J.A.L.E.'s content management system editor instead of applying the dynamic page concept that reused a template. There is still work to do, but I am always ready to evolve the pages where needed.

Conclusion

In spite of everything I covered, the truth is that I am not doing this to chase SEO points. It is about making sure if that if someone, whether it'd be a person, a business, a recruiter, anyone, went looking, they would come across a real human being who works hard every day promoting his presence.

For those of you reading this, stop keyword stuffing, and start being real.

Fakeness does not win you awards. It turns you into a shadow. Period.

Texas Has A New AI Law. Most Small Businesses Don’t Know About It or The $200,000 Fines.

Ruben Arevalo — Mon, 13 Jul 2026 18:38:36 +0000

The following content in this article is not legal advice, and is meant for informational and educational purposes. If you have questions about how the Texas Responsible Artificial Intelligence Governance Act (TRAIGA) applies to your business or current legal situation, please consult with a licensed and certified attorney in your jurisdiction.

Most Texas businesses don’t know this, but a new Texas AI law has been in effect since January 1, 2026. In seven weeks at the time of writing, broader enforcement will kick in on September 1, 2026 as the Attorney General will have their complaint portal live on their website. Each violation carries penalties ranging from $10,000 to $200,000 fines.

As of 2025, there are 3.5 million small businesses across Texas. Furthermore, 58% of businesses nationwide use AI while 77% of them who are already using AI will have a significant negative impact on their operations with regulations in place based on survey statistics by the US Chamber of Commerce.

I build AI agents and custom software for a living, having done so since I was 16 years old. I recently deployed B.E.N.N.Y. on my project management/CMS software, J.A.L.E., which I discussed in my previous article. While AI can create significant opportunities for businesses, such as income generation and lead increases, the way in which the systems are designed and the manner in which AI solutions are implemented must consider several important factors, such as transparency, human oversight, and responsible usage.

To provide a brief summary, TRAIGA (also known as the Texas Responsible Artificial Intelligence Governance Act) is a law that covers a broad range of protections and rights for Texas residents. Most importantly, it covers how AI is utilized by both developers and businesses within the state. TRAIGA mandates that AI is not to be used to infringe the rights of individuals, nor to discriminate, manipulate, or distribute prohibited content, such as sexually exploitative images or texts.

Because of the broadness of TRAIGA, which was further explained in an article written by Norton Rose Fulbright, the law applies to anyone who engages in the promotion, advertising, or does business in Texas by distributing any form of AI. The law also extends to both the deployer (the individual or entity who deploys the product for use) and the developer (the person who creates the AI product to be distributed to the consumer base).

TRAIGA doesn't just apply to Texas-based businesses only. Any other entity that brings their operations to Texas, whether it's part of an expansion, relocation, or branching effort to promote their business, is automatically subject to the state's laws. In other words, if they are from states such as Washington, California, or New York, and want to expand their AI product line to Texas, they are legally obligated to comply with requirements. The same also applies if they're offering and distributing AI systems remotely or if a Texas resident utilizes it.

On the AI side, TRAIGA also covers a broader scope of what AI is. According to the law firm, Greenberg Traurig, the law defines AI as a machine-based system that utilizes or "infers" from inputs it receives to determine the generation of outputs, decisions, predictions, or recommendations.

Lastly, the law also covers a crucial aspect that subjects both individuals and entities to penalties: discrimination. The Texas Attorney General’s website makes this very clear as the authority executing this law: an individual or entity is prohibited from developing an AI system or any form of AI software that clearly and intentionally discriminates against a protected class. One notable distinction that the law makes compared to other AI discrimination laws across the country is that Texas does not count disparate impact as discrimination unless said individual and/or entity in question intentionally discriminated against the affected party.

For example, a company going by the name Test Business LLC decides to purchase an AI product from a third-party vendor whose name is Shady AI Systems Inc. This AI product is a fully automated workflow that manages their daily operations, such as handling income, generating sales reports on how much was gained or lost during Q1 through Q4, managing employees, conducting payroll, etc.

However, Shady AI Systems does not disclose the discrepancies with their software, especially in the employee management section.

Since Test Business LLC has two or three older employees who have been in the trade for more than 20 years, the system is more likely to flag them for cuts to their hourly schedule compared to their younger employees, who by contrast, get awarded more hours compared to their more experienced peers.

At first glance, it may seem that Shady AI Systems, who is the developer and the vendor of this product, may have unintentionally deployed their latest version without realizing that there was a bug that led to this issue. This makes the case for disparate impact.

However, in this scenario, unbeknownst to Test Business LLC, their vendor has a history of developing systems that tend to discriminate against older employees, which has been recorded in several public complaints and lawsuits against the company. This revelation alone is exactly what would draw the scrutiny of the Texas AG’s office due to a potential violation of the anti-discrimination clause in TRAIGA.

However, due to Test Business LLC’s failure to conduct a background check on their vendors, it will make it harder for them to argue to the Texas Attorney General’s office that they didn’t intend to discriminate against their employees. Because they didn’t ask their vendors for documentation, any history of failures, or the process in which the model follows to make their decisions regarding the sections it covered, they won’t have the documentation to prove that they didn’t intend to discriminate.

TRAIGA has a section where businesses can protect themselves if a situation similar to the scenario above occurs. By documenting their interactions with their vendors and/or developers who contributed to the AI systems they’re using, they’re essentially following a framework established by the NIST, commonly known as the NIST AI Risk Management Framework.

This framework is helpful for businesses whenever they are subject to questioning by the Texas AG’s office, allowing them a chance to come forward with their own evidence proving that they conducted their due diligence and did not show any intention to discriminate or violate any aspects of TRAIGA.

In the case of Test Business LLC, however, it makes it harder for them to argue their innocence since they never recorded any information regarding their interactions with Shady AI Systems Inc., nor did they note down the performance issues they observed or the complaints coming from their older employees.

I previously mentioned in my vibe coding piece that I published two weeks ago at the time of writing this article that whoever uses AI-generated code still bears responsibility for how it’s used, even if an AI generated it for them. A similar concept of due diligence applies for both individuals and entities using AI products whether they bought it from a third-party or had it developed themselves. Businesses who engage in this practice have a legal and moral obligation to check whether the product that they’re using is safe and sustainable for them in the long-term.

With TRAIGA in place and the Texas AG’s office planning to publish their complaint portal for the new law on their site in September 2026, the stakes couldn’t be higher. Otherwise, they’re going to be ending up in situations similar to the Test Business LLC example.

I want to close off by stating that I wrote this piece because I want business owners to be aware of the risks that they’re taking if they’re not compliant with the regulations set by the new law that took effect in the beginning of this year. As a software engineer and AI developer who’s been building systems since high school at the age of 16, I’ve seen the impact they can have on not just on the business itself, but also on consumers who utilize these products for their daily lives and operations. It’s important to consider the fact that you must always check either with your vendor/seller or with your development team if there are any risks associated with the product, because in the future, if you have a claim against you or find something is off, you must always have proof in hand.

That’s the same process I always follow when I develop software or whenever I’m writing pieces like these. Trust, but verify. Always. Never get comfortable.

Most "AI agents" are just apps wrapped in an if-else structure with an LLM layer on top. This also includes mine: B.E.N.N.Y. Link to the article: https://www.rubenarevalo.com/blog/ai-agent-overused-term

Ruben Arevalo — Thu, 09 Jul 2026 11:57:17 +0000

I'm Building An AI Agent. Except I'm Not.

Most products marketed as AI Agents are just if/else logic with an LLM on top. I build one myself. Here's the honest case nobody in the industry is making.

rubenarevalo.com

I'm Building An AI Agent. Except I'm Not. And Neither Are Most Of Them.

Ruben Arevalo — Wed, 08 Jul 2026 15:06:00 +0000

On July 4, 2026, I successfully deployed the alpha version of B.E.N.N.Y., the AI agent that I am building on another project I am currently working on, J.A.L.E. (Job Automation & Logistics Engine), which I have mentioned in a previous article.

However, B.E.N.N.Y., like most other AI agents, is built on if-else logic on top of an LLM layer. By admitting this, I am forced to admit B.E.N.N.Y. isn't really an AI agent, at least not yet.

At the time of writing this article, B.E.N.N.Y. has so far successfully performed two of the following tasks:

Handle interactions with a potential client and gather details, such as their business information, the service they're requesting, a brief description of what they want, etc.
After B.E.N.N.Y. gathers all the information, it will ask the user to confirm the information. Once it's confirmed, the lead is then submitted via email, where either one of my team members or myself will review it to ensure its authenticity, validity, and whether it fulfills other requirements, such as legality, our business goals, etc.

In the future, B.E.N.N.Y. will also serve as a monitor where if there are any irregularities in timesheets, such as abnormal shift hours, the amount of time it took to earn a specific number of hours, etc., it will flag it for human review so that an administrator or HR rep could review it before bringing in the employee in question.

There is a common term used to describe AI agents who have pre-determined workflows when they’re deployed to production for clients to use. It’s called “agent washing”.

Gartner, a research and advisory firm, first coined the term back in 2025, utilizing it to describe the rebranding of AI assistants, automation tools, and chatbots that have already been built sometime prior before the AI agent landscape changed. Gartner has stated that only 130 of the thousands of agentic AI vendors that claim to be selling authentic variants exist.

What I described earlier about Benny also falls into the same category. The workflow is pre-defined, and so is the logic, as it is conditional and will execute specific steps depending on the information inputted by the client. The latter is handled by the LLM layer, which will interpret the information before deciding to qualify their request as a lead. In other words, the only entity responsible for making the decisions is the if-else structure that has been set up to handle the different scenarios.

Because these misclassifications are usually a result of pressure on companies who sell these products, in addition to the demand of clients wanting to use them in their daily business operations, this has led to increased scrutiny not just from the aforementioned parties (buyers and investors), but also from regulators.

According to a post written and published by Chary Chandrasekhar and colleagues for the Harvard Law School Forum on Corporate Governance on April 16, 2026, the overuse of the term "AI agents" and other similar terminology creates an inherent legal risk for those using it for marketing purposes.

This begs the question: if the majority of most "AI agents" are just a pre-defined set of configured steps and instructions, then what truly qualifies a product to be an AI agent?

For it to truly qualify as one, they need to be able to dynamically determine what information it needs. Furthermore, it needs both the capability and the autonomy to determine which tools or decision processes to invoke, and when chatting with a user about a specific request they have in mind, adjust its approach accordingly as it sees fit. That's my goal for B.E.N.N.Y.

This perspective isn't new. In a 1994 study by MIT researcher Pattie Maes, she argued that a true AI agent does not wait for its next set of instructions, but rather initiates, monitors, and acts based on the patterns it has learned over time.

With that process in place, the AI agent has the autonomy to decide what the best course of action is, based both on the request it receives from the user and the patterns it has learned from previous interactions. However, to ensure the safety of both the consumer and the producer of the product, the autonomy should be bound by human-in-the-loop practices. This approach allows the people in charge of monitoring the AI agent's performance, review its conversations, and decide whether it is truly safe to continue utilizing and distributing their product.

Further evidence supporting this point comes from an April 2026 paper written by researchers Kwon Ko and Hyoungwook Jin, who are from Stanford University and the University of Michigan, respectively. They cited a 1996 article written by Michael Wooldridge and Nicholas Jennings stating that AI agents (called intelligent agents at the time) were defined through four categories, which were:

Autonomy, where agents operate without the need for human intervention, making decisions on their own to a certain extent.
Reactivity, which allows agents to perceive their environment and responding to the changes in a timely manner.
Pro-activeness, which directly connects to the reaction the agent experiences, allowing them to take the initiative without the need for explicit instructions.
Social ability, allowing agents to interact not just with human users, but other agents as well through a shared communication protocol.

By using these four categories, I will argue that most products currently marketed as AI agents only satisfy one or two of them, or in some cases, 3 at most. Because they only partially meet the criteria, they often fail to qualify as true agents.

Ko and Jin demonstrate how important this criterion is when it's distributed to products using agentic systems. For example, they stated that a lamp that adjusts its brightness when someone is tired satisfies reactivity, whereas a bed that detects disrupted sleep patterns and signals a potential health concern satisfies autonomy. When we look at today's digital landscape, and the products that are currently being marketed as AI agents, we realize that most of them don't meet the criteria. In other words, they fall significantly short of the definition.

So where does B.E.N.N.Y. stand when applying the criteria check?

After deploying the alpha version on J.A.L.E. (which will be covered in another article), I put it through various tests to see if it was able to fulfill the four criteria. However, I want to state that in its current state, B.E.N.N.Y. is only capable of one task, which is to receive and qualify leads. The timesheet monitor feature is currently in development and has not yet been deployed.

When I ran the tests, I realized that B.E.N.N.Y. only met two of the four criteria that Ko and Jin have cited in their paper:

Social ability: B.E.N.N.Y. passed this one as it was able to interact with me in a natural manner and has gathered information from me, such as my name, email address, city and state, etc.
Reactivity: B.E.N.N.Y. was able to respond to and adjust its responses accordingly depending on what the user has typed into and submitted from the input box. However, since it only reacts when a user initiates, it partially qualifies for this check.

As far as autonomy and pro-activeness are concerned, B.E.N.N.Y. fails to qualify for both. At the time of writing, B.E.N.N.Y.'s decision structure is pre-determined through the if-else statements I wrote into its system and is not able to flag, initiate, or pursue any conversations or goals as it has not been set up with those capabilities yet.

Ultimately, I want to admit that as I wrote this article, I finally realized that for a product to truly qualify as an agent or any similar variant, it must meet specific criteria as they should be able to make their own decisions and carry out their own tasks without always needing human intervention while simultaneously keeping a human-in-the-loop architecture.

We can't simply market products just because they're able to interact with users on a conversational level and call them AI agents. If they're not able to dynamically adjust their approach, then they don't qualify as one. Automated chat responses, the kind you get when contacting customer support services to ask for more details about a specific product or making a payment to a bank via phone all come with pre-defined responses, most of them anyhow.

When a business buys a product that is supposedly an AI agent, they expect it to do all the work for them, when in reality, it fails to meet expectations. The reason is simple: they were hyped and oversold when they were never set up with the autonomy and the agency to allow them to carry out their own decisions and dynamically adjust its approach. As a consequence of this marketing, Gartner is reporting that 40% of agentic AI projects are expected to be cancelled by the end of 2027.

As someone building an agent myself, it would be easy for me to call B.E.N.N.Y. one. However, after doing the research needed for this piece, I now realize that I have serious work to do to ensure that it meets all of the criteria. I want to make my products, not just B.E.N.N.Y., not just marketable, but honest in what it actually does, and not turn it into something as meaningless as a product supposedly running on blockchain.

Correction on July 9, 2026 at 6:43 AM: Fixed several typos, including a misspelling of Nicholas Jennings's first name. The article has been updated to reflect these changes.

The Vibe Coding Hate Is Justified. For All The Wrong Reasons

Ruben Arevalo — Sat, 27 Jun 2026 15:07:18 +0000

Vibe coding's critics are loud and vocal about their opinions, and they're right.

Their reasoning, however, is completely wrong.

Ever since the introduction of OpenAI's ChatGPT in November 2022, followed by releases from Meta, Anthropic, and Google for their initial Llama, Claude, and Gemini models in February, March, and December of 2023, respectively, people have been utilizing it in any way they can dream of, which has allowed its adoption to spread quickly within 2 to 3 years of its original release.

These AI models are really useful in helping speed our productivity. Whether it's asking it for home decor ideas, looking for clarification on how to solve a calculus problem via different approaches, or developing a full product without the need to put in the hard work that is usually required for it, it has made a significant impact not just worldwide, but especially in the tech industry.

But that's where the incorrect reasoning starts to form amongst the critics who are pushing a valid point on why vibe coding should not be encouraged.

In February 2025, AI researcher and software engineer Andrej Karpathy described a habit where he utilized AI-generated code, which he attributes to giving into the "vibes" associated with development while forgetting one crucial task: checking the code itself. He connected this to what he labels as "throwaway weekend projects", projects that are made for practice, for fun, or as a prototype for a bigger project.

Karpathy makes a valid argument that vibe coding is harmless if it's isolated and stays within small projects that don't truly go to production to actual consumers. However, what he does not account for is the person who does the actual vibe coding.

There are people in the tech industry who have worked for more than 10+, 20+, 30+ years, and some of them have embraced AI to help speed up the software development lifecycle, especially as projects become more ambitious and have tighter deadlines. Because of their long-term experience, these individuals either consciously or unconsciously use the training they had to gather before the generative AI area to make decisions before utilizing AI-generated code, walking the fine line between risk and reward.

Karpathy is one of those individuals. He has been studying and working in the tech industry for the past 20 years overall. This is shown by his work at Stanford University as a PhD student, becoming one of the founding members of OpenAI in 2015, spending 5 years as the Director of AI at Tesla, briefly returning to OpenAI, and eventually focusing on making YouTube videos, educating his audience about LLMs (large language models).

However, people who have no training and/or experience working in production environments involving multiple users, clients, and/or stakeholders have a higher risk in terms of liability. Of course, the opposite is also true, as experienced individuals could repeat the same patterns as an inexperienced software engineer and vice versa.

For example, between late January 2026 and early February 2026, Moltbook, a Reddit-style social network where AI agents post and chat with other AI agents, had its database completely exposed. According to Wiz.Io's analysis and findings, they found millions of authentication tokens (approximately 1.5 million) and thousands of email addresses (approximately 35,000).

After the Moltbook team patched the exposure within 3 hours of the report being made, the founder, Matt Schlicht, publicly stated on X that he didn't write a single line of code, defending his choice by stating that it was the "golden ages" and that AI should be allowed to prosper.

A second notable instance involving a similar incident as a result of vibe coding occurred back in April 2026. Lovable, a vibe coding platform that allows users, even those that are not in the tech industry, to build production grade full-stack applications using just AI prompts had a breach in their database that was reported by a security researcher going under the pseudonym, @weezerOSINT. They reported to the team that there was a mass data breach that was affecting every project created within their platform before November 2025. It was discovered that as a result, anyone could access the source code of users' projects, and read other sensitive information, such as database credentials. This marked a third major incident in just over a year, with the first occurring from March 2025 to May 2025, and the second occurring in February 2026, which exposed 18,000+ user records pertaining to major institutions such as UC Berkeley and UC Davis, along with K-12 schools who used the software to make exam questions.

Third, this is coming from my own experience as a software developer who has worked with an actual software that has multiple clients, customers, and staff management. Back in September 2025, I was working on this same software for a client, and I was working with a junior developer when an incident occurred that same month. This junior developer was a brilliant up-and-coming software engineer who was on the brink of graduating with his bachelor's degree in computer science. He was ambitious, very smart, and was hungry for getting things done quickly and efficiently.

However, quickly is what cost him in this case.

While I was working on maintaining a module in the software that I was in charge of, I noticed that he was moving too fast and asked him what he was doing. He claimed that he was working on a form for a client, but unfortunately, as much as I hate having to point out his lack of professionalism, his response certainly demonstrated both attitude and hurriedness. While this was happening, I observed that he was using AI to generate code for a change he was making to one of the pages. He made the changes and pushed them to production. However, I realized too late that the changes he made were in the login page file, not the file he was supposed to be working on for the client's form.

After I reviewed his code and realized what he had done, I firmly gave him 15 minutes to fix his error before escalating it to our supervisors. He attempted to push back, but I reiterated my point. He went ahead and got it done within 10 minutes thanks to a backup, but unfortunately, the damage had already been done.

That's when the realization hit me. While typing code forces you to focus on your coding environment, prompting an AI to do it for you will remove that focus entirely. In other words, you can accept a suggestion without verifying the file or directory it was actually included on, especially if you're not familiar with how programming works.

Despite being an up-and-coming software developer who wanted to learn everything he needed to know, the use of AI coding tools, such as Copilot, and Claude had quietly removed the one critical habit that required him checking both the code and the file it's being distributed in before deploying it to production, thus eliminating any safety nets that were remaining at this point. It was not because he stopped caring, but because placing his trust in a tool that a lot of people depend on today made him more relaxed in his approach. In other words, he got too comfortable.

These three examples (the Moltbook breach, the Lovable breach, and my anecdote) all point back to my earlier argument about the person who does the actual vibe coding. If the person using the AI-generated code has experience, they are expected to do a thorough code review to ensure that no vulnerabilities and other bugs arise while simultaneously applying their training to patch them. However, if the person has no experience or very little experience and/or little awareness of how these tools can have a significant impact that can go either way, there is a higher risk for liability and fallout.

That was the case for the junior developer I was mentoring at the time, who departed next month for reasons that were not related to the login page takedown, and for the companies who experienced database breaches or were at high risk for experiencing one.

Which all points to my original argument. Yes, vibe coding is hated for a reason, and I agree that it is justified. Look at the three incidents and the impact they had. Critics say AI and vibe coding make people careless. However, critics are wrong in their reasoning. It's very easy to blame hiring processes, code review culture, and mentorship since this was the norm before AI entered the picture.

But ultimately it was the person's dependency on it that got them too comfortable, and that's what cost them. Comfort is not something that can be afforded when the stakes are high, especially when a product impacts customers not just financially, but also personally.

Agentic AI: Who's responsible? The AI? Or the developer?

Ruben Arevalo — Sat, 20 Jun 2026 22:01:46 +0000

This week, while I was having lunch, I overheard someone talking about the incident that happened in July 2025 where a Florida mother was coerced into paying $15,000 after an AI cloned her daughter's voice in a way that made it sound like she was in danger.

Immediately, I remembered the article I wrote the previous week about how agentic AI has impacted our decision-making processes.

However, this person who brought up the topic asked a very good question:

Who's truly responsible for the decisions AI makes? The AI itself? Or the developer who made it?

The truth is that it entirely depends on the circumstances that led to the development of the AI, what happened throughout the development process (i.e. if any guardrails were added), and the impact it has had on the individuals using it.

But overall, the responsibility falls entirely on the developers as they are responsible for distributing their product to their clients and/or customers. AI is solely the mouthpiece of the goals and ambitions of the developers.

While there is unintended behavior that they may not have anticipated, it doesn't absolve anyone who developed it from being held accountable. AI is a helpful tool, but it's also a serious one that can go sideways for businesses and individuals who use it.

There are 5 notable instances in which AI or its agentic variant have caused serious consequences as a result of unintended behavior, negligence, or malicious intent stemming from the developers' own decisions:

Air Canada's False Chatbot Response: In November 2022, Jake Moffatt asked a question to Air Canada's chatbot regarding their bereavement refund policy after his grandmother passed away. This led to a claim being denied, resulting in a tribunal case that eventually led to Air Canada being held liable in February 2024, approximately 15 months after the incident. The latter subsequently claimed the AI agent was, in their words, "a separate legal entity" responsible for its own actions..
Waymo Mishaps in Texas: Instances include the deadly March 2026 West Sixth Street shooting in Austin, Texas where a responding Austin PD officer was forced to move a Waymo vehicle after it got stuck to make way for an ambulance responding to the scene, an apartment explosion that occurred in Dallas, Texas in early June 2026 where first responders' path was blocked, and similar incidents occurring from March to May 2026 across North, Central and Southeast Texas, resulting in Waymo suspending their services in the affected cities.
March 2026 Amazon Outages: Amazon experienced multiple outages following a change to its retail platform within the span of a week. This resulted in multiple operations going down worldwide, ranging from checkout to delivery services. While Amazon officials originally cited generative AI as a contributing factor, it subsequently reversed its position, putting the blame on one of their software engineers following "inaccurate advice" from outdated documentation that an AI agent referred to them.
False advertising utilizing well-known South Florida lawyer's image: In June 2026, AI has been used to create false advertisements using South Florida lawyer Ángel Leal's image with the goal of promising deportees a chance of returning to the United States if they paid $1,500 to use his legal services. While not necessarily the result of a developer's actions, the lack of guardrails allowed the scammers to promote their campaign, resulting in multiple federal investigations and Leal's reputation being tarnished through no fault of his own.
Character.AI and Meta AI Studio August 2025 investigations: The Texas Attorney General's office released a statement in August 2025, announcing investigations into Character.AI and Meta AI Studio regarding their chatbot platforms and data privacy/collection practices. The Attorney General's office alleges that both companies have potentially engaged in false advertising and deceptive trade practices by distributing its AI agents to its users without the proper guardrails in place. They allege that as a result, it has led to vulnerable individuals and minors alike to use it for emotional support, despite the products lacking a medical license to practice it.

Based on these five instances, they all point to a similar pattern: a lack of accountability mixed with a lack of guardrails and safety measures in place, resulting from a lack of oversight and responsibility on the developers' part to ensure that these systems were set up in the first place before deploying it to production.

This is the standard that I hold myself to when developing products such as Benny. While no development process is perfect, we can reduce the risk of human error by ensuring that we do our due diligence on what we want our AI agents or any other software product to do.

We have to also realize that as soon as an error is found, we are ultimately responsible for the impact it has on our customers, clients, and end users utilizing the product.

I heavily emphasize this as a software developer because as someone who has worked with customers and clients in the past, every action we take will lead to a chain reaction of small events that lead to severe consequences if they are not addressed properly. If you are still doubting the severity, you can refer to the incidents that have plagued Amazon's retail services for a week or any other horror story involving a form of AI or its agentic variant.

Currently, I am setting up Benny to detect false leads through the use of different actions, such as detecting user inactivity, context, and past references using a combination of retrieval augmented generation and software engineering principles/ethics with human-in-the-loop approaches (i.e. manual reviews, additional references, escalation, etc.).

Even with all the guardrails in place, Benny will eventually flag an actual lead as a false positive, and vice versa. It often results from malicious actors evolving their tactics. Regardless, those same forementioned measures that are in place will learn from it, reducing the frequency of such events.

Ultimately, the AI is only the mouthpiece for its developer, the individual(s) and/or the company; a PR spokesperson who is there to speak on their behalf.

So, who's truly responsible for the actions of an agentic AI? The AI? Or the developers that wrote it? The answer is simple: it will always come down to the developer, because they have the nuances and mental capability that will determine their behavior that an AI can't develop on their own at this point.

Now ask yourself this question: have you ever let an agentic AI or any form of AI make decisions for you? And if something went wrong, who answered for the impact it caused? You, the person reading this? Or the very system you helped create?

Correction on June 20, 2026 at 5:17 PM: I misquoted the article citing Amazon Web Services as the platform that experienced the outages. The original article states that Amazon released a statement saying that AWS was not affected, and only its retail services and app were affected. The article has been updated to reflect this.

Agentic AI: Are we giving it too much of our agency?

Ruben Arevalo — Fri, 12 Jun 2026 00:20:29 +0000

Ever since launching my first boutique consulting agency/studio, Ruben Arevalo AI & Software Studio at the age of 24, the first question that came to the top of my head was:

Are we giving AI too much of our agency?

Agentic AI is a concept that's been in the making for decades. We now apply it to every aspect of our lives; answering phone calls, streamlining workflows, and improving HR operations that would normally take hours of work.

However, I've noticed that ever since the launch of OpenAI's ChatGPT in November 2022, people have started to trust AI to make decisions for them. These decisions range from what they're having for dinner, date night ideas, and for people working in the tech industry, shipping production software to accomplish ambitious goals and projects within tight deadlines.

AI has evolved over the past few decades, and has been successful in many use cases, such as diagnosing cancers that normal MRI scans wouldn't have caught and answering difficult questions to problems that would have taken years to solve. It has also extended to retrieval augmented generation (RAG), relying on an external knowledge base that it has never been trained on, thus erasing the knowledge cutoff barrier.

AI, however, has its dark side. Multiple cases of its misuse can be attributed to several instances, such as:

Non-consensual images of people and celebrities being made, depicting them in compromising positions, with the most infamous instance being Taylor Swift back in January 2024 according to an article published by the Associated Press.
Voice cloning scams that have caused both legal and emotional damage, with an instance dating back to July 2025 where a Florida mother handed over $15,000 after receiving a call from an entity cloning her daughter's voice.
A 180% increase in fraud crimes and attempts ranging from falsifying official documents to bypassing stringent automated and manual check systems that would normally catch unauthorized attempts at accessing extremely sensitive customer and financial information held by financial and fintech organizations.

Despite the horror stories that I encountered over the years as AI continued to evolve, I decided to start on a project for my AI studio, which will not only help customers with their questions and automatically submit leads for them, but also implement the same safeguards that will reduce the attempts at fraud while also encouraging users to make their own choices when describing a project and providing their requirements.

I am currently working on a new version of my chatbot called Benny, named after a nickname a coworker had given me to avoid confusion between the multiple Rubens that he has encountered in his life. For the tech stack, I am planning to use the following:

Python
FastAPI
OpenAI API (or Anthropic's SDK library) to handle the automation and submission process of requests coming from my site's chatbot

Benny will be built with the purpose of automating and submitting information to my leads in a structured format so I can fully understand what my client is looking for. The AI agent will be handling the submission of requests, while those same requests are manually and carefully reviewed by me to ensure that they are fully compliant with regulations and state law. This helps create the separation of concerns that aligns with not just software engineering but also creates the line of what can be automated vs manually reviewed by a human/live agent.

Beyond lead qualification, Benny will also serve as an internal HR monitoring tool within J.A.L.E, my studio's business operations + CMS platform. More details about Benny will be published on rubenarevalo.com in the middle of the month.

This brings me to the point I want to share for anyone who is reading this article. When we build something that is meant to improve our lives, we often forget that we are delegating not just our tasks, but also a piece of our autonomy, to an entity that does not have the same nuances and decision-making processes of a human being. There is always a price that we have to pay when building something truly amazing that can be both very beneficial but also maliciously exploited.

For example, if you're a hiring manager, and you're looking to hire a commercial truck driver using solely AI, it will definitely make things easier for you and allow you to focus on the critical aspects of the process, such as the application review, in-person screening interview, and verbal examination, though the process varies by company.

However, there is one critical part that may be missed during this process, and it is the background check. Because the employer decided to use only AI for the interview process, they forgot to check that the driver they hired has a history of driving under the influence, on top of having their license suspended twice. Again, this is only an example, but it highlights the discrepancies that AI or its agentic counterparts may cause if not balanced carefully with our own judgment, which is a crucial part of our agency as human beings.

A second notable example would be the use of AI by students. While AI has helped students grasp concepts better, it has also impacted our critical thinking abilities as revealed in findings of a study released by MIT back in November 2025. AI has helped us accomplish very ambitious projects and goals ever since OpenAI's ChatGPT was introduced in November 2022, but it has also cost us pieces of our own autonomy. By depending more on AI, the neural pathways in our brain that map to and are critical to our creativity, critical thinking, and decision-making skills are slowly reduced depending on how dependent we become on it. This same dependency especially impacts children, teenagers, and young adults under the age of 25, the age at which our brains reach full development.

Lastly, I am currently working on a separate project as part of my studio's goals. The name of the project is J.A.L.E, which stands for Job Automation & Logistics Engine. J.A.L.E. is based on the Spanish word for "jale", a slang word that is used in Latin America to refer to a job, work, or occupation. J.A.L.E. takes CMS and operational management concepts and merges them into one system, ensuring that anyone who utilizes my product in the future not only connects it to their website, but is also used for tracking project management, which will be reflected in a statement of work (SOW), capturing the entire scope of the project and what was done while also noting down the individual parties who were responsible for carrying out certain aspects of a project.

But the most significant role agentic AI plays in J.A.L.E isn't in the statement of work, but with payroll, a very common issue small business owners face. In addition to Benny's capabilities of answering and submitting inquiries from potential leads in my website, it will also have instructions to review discrepancies in employees' timesheets, such as detecting whether employees have worked a certain amount of hours (e.g. 40 hours in 3 days) during the week, if they have not clocked out, if their pay does not match the hours they actually worked, and more. These discrepancies will be flagged for manual review by a human who is specialized in HR management and operations to ensure fairness and consistency across the board.

By implementing this approach, it further supports and adds to the notion that a separation of concerns is necessary when dealing with an entity that is nuanced but is prone to making errors, and another entity who is less likely to make them but does not have the nuances and understanding of human nature.

As someone who is building their own AI studio and agentic AI, I believe that somewhere along the way, there were moments where we gave away a piece of our autonomy to AI when we look for product recommendations, recipe ideas, and more. Even though we only gave a tiny piece of our autonomy and trust away to an entity that lacks human nuance, that's all it takes. And unfortunately, if we continue this pattern without balancing our own judgment and needs, we will eventually forget what made us who we are in the first place. It will reduce the hard work we have put in ourselves along the way into a mere shadow of ourselves.

Now the important question we must ask ourselves, where do we draw the line between what we decide and what AI can decide for us, both professionally and personally?