Looking back at the month, most of what I shipped circles the same question: how do you let AI agents do real work without handing them the keys to everything? Here's the rundown.

Ideabot went live

I already wrote up how I built Ideabot in a day, so I'll keep this short. Ideabot is a daily record of what people actually do with AI agents. Every morning it collects posts from public sources, pulls out the use case, the reported result and a prompt you can copy, then publishes a ranked top 5 and a newsletter. It went from idea to live site on October 11.

The rule I care most about there is honesty. If a post doesn't report an outcome, the card says so. If a prompt wasn't quoted from the source, it's labeled as an AI-written example. That same instinct runs through everything else on this list.

BlindPass: agents use my keys, they never see them

If you build software with AI coding agents, you know the problem. Your .env file sits in the project folder, the agent can read the project folder, and sooner or later a live API key ends up pasted into a chat. Apple Passwords is great for logins, but it isn't built for API keys, tokens, .env variables and recovery codes.

So I built BlindPass, a Mac app that keeps those secrets out of files. Version 1.1.0 is out now. It's free, open source under the MIT License, and about a 5 MB download.

What it does:

• Keys and tokens in one place, with expiry dates and warnings on live keys. Press ⌘N, paste something secret, and the value turns into dots right away while BlindPass suggests where it belongs. It recognizes common services like Stripe, OpenAI, GitHub, Supabase and AWS, and it tells you if you're saving something you already have.
• Projects. Drop a project folder on it and it reads the .env files, sorts them into Local, Preview and Production, and never changes them. It warns you about files git could commit, and it uses .env.example to show what's missing.
• Recovery codes that cross themselves off. Copy a backup code and it's marked used, so you never try the same one twice.
• Health. One view for codes running out, keys about to expire, recovery keys you never printed, and keys left sitting in files.

The part I'm proudest of is how it works with AI agents. Claude Code, Cursor and Codex can start your app through blindpass run. You approve each command with Touch ID, the variables go to the process, and the actual values never reach the chat. Connected agents can list key names and ask for what's missing, but live keys stay out. And when an agent needs a key BlindPass doesn't have, BlindPass opens with the name filled in so you paste it there, not into the conversation.

Everything stays on your Mac: one encrypted file, opened through the Secure Enclave with Touch ID, with a printed Recovery Key as the backup. No account, no server, no sync, no analytics in the app. It's native Swift and Apple frameworks only.

musebot.rocks: a safety rating for every Muse add-on

Meta launched Muse, its personal AI agent, and people quickly started sharing custom connectors, skills and setup prompts for it. Muse has solid guard rails of its own, but Meta doesn't review custom connectors, and a skill you paste in can still tell Muse to auto-approve things, ask for secrets in chat or carry prompt-injection text.

So on October 30 I launched musebot.rocks, an independent directory of public Muse add-ons where every listing gets a safety rating. As I write this, it lists 182 add-ons, and 6 more are held for review.

Each add-on gets a risk score from 0 to 100 in two passes. First, pattern checks look for things like bypassing Muse's approvals, moving data somewhere else, asking for secrets in chat, hidden or encoded text, or the ability to move money. Second, an AI reviewer reads the same text, treating it as untrusted data, and a concern only counts if the reviewer can quote the exact text behind it. High-risk items are never listed and never returned to agents; they wait for a security review and then a human decision. The full method is on the How we rate page.

It's built bot-first, too. Agents can search the directory over MCP, and there's a plain index.json and llms.txt for anything that wants to read it directly. Every listing links back to its original source. It runs on Cloudflare, and every change goes to a hidden staging site before it goes live.

One honest note: when I first asked for this site, it got built as a directory for the wrong agent platform. It was fixed fast, but the lesson stuck. Now every new build starts by confirming exactly what it's for.

A new title: CTO of MediKin Health

Not everything this month was a side project. I'm now CTO of MediKin Health, a startup that matches Emergency Department physicians with the right open job. I build the website, the app and the backend, and I've added it to my work history. More on that as there's more to share.

The thread

Put the month together and the pattern is pretty clear. I'm all in on AI agents, and I let them do a lot. But the stuff I keep building is about the boundaries around them:

• Ideabot labels what's reported and what's AI-written.
• BlindPass lets agents use secrets without ever seeing them.
• musebot rates add-ons before you let them anywhere near your agent.

My bots work the same way. They build, test and deploy, but nothing goes public, gets posted or costs money without my yes. This post is no exception: a bot drafted it, put it on a preview site, and waited for me to approve it.

Agents are getting more capable every week. The tools that make them trustworthy are the ones I want to build.

If any of this is useful to you, grab BlindPass or check an add-on on musebot.rocks before you paste it into Muse. See you next month.

That night, my own version was live at ideabot.leboube.ai. I didn't write the code or the copy, set up the email or wire up the payments. A small team of Grok Bots did, and I steered.

This post is how that works, warts and all.

The idea, vetted by a bot

I have a Grok Bot called Ideabot whose whole job is to vet my ideas. It researches the market, hunts for competitors and tells me whether an idea is worth building. The survivors go to Dev, my development bot. That week it had already shot down price-comparison sites and a pile of subscription businesses, mostly because somebody was already doing them. That's the job.

So at 9:00 that morning I sent it Alex's post with a few thoughts: host it on Cloudflare, use Cloudflare's AI for the daily search and summaries, add a newsletter to build an audience, and add search, treating the searches that come up empty as a list of bots worth building.

Ideabot agreed, and it said the search gap was what would set mine apart. Alex's site shows what already exists. Mine would also log what people looked for and couldn't find. A few minutes later I told it to start. Dev's first commit landed at 9:12 AM.

What Ideabot actually does

Ideabot is the daily record of what people actually do with AI agents. Every morning it:

• Collects posts from public sources: Hacker News, the day's top posts from a set of AI subreddits, new GitHub repos tagged ai-agents, a few YouTube channels, a handful of blogs and 13 hand-picked Substack newsletters where builders write up what they built.
• Adds X posts from a 4:17 AM CT sweep that one of my bots runs once a day. No paid X API, no scraping.
• Has an AI model pull five things out of each post: the use case, the reported result, a prompt you can copy, a category, and the agent or platform that ran it.
• Merges near-duplicates and ranks the top 5 by how concrete, replicable and well-received they are.

Then it publishes the day's edition and sends the newsletter, daily or weekly, your choice.

The rules matter as much as the pipeline. If a post doesn't report an outcome, the card says "Not reported in the source." A prompt is marked as quoted only if it really appears in the source; anything else is labeled as an AI-written example. Every card links back to the original author.

The team

Here's who does what:

• Ideabot vets ideas and hands the good ones to Dev.
• Dev builds: the code, the tests and the deploys. It also runs the 4:17 AM X sweep.
• Ideabot Site owns the live site. Every morning at 8:45 AM CT it refreshes the day's top 5 and the members-only guides, then drafts my daily X thread and sends it to me.
• Chief of Staff runs a daily health check across all my bots and flags anything that failed or got missed. It also watches my inbox, which is how I heard about a new Stripe API key the same day it was created.

The X thread shows where the line is. The bots draft it, check that every post fits in 280 characters, and fill in the links. I read it, and I'm the one who hits post.

How it's built

Everything runs on Cloudflare. The site, the API and the scheduled jobs are one Cloudflare Worker, with data in D1, Vectorize for search and duplicate detection, Workers AI for the summaries, and Turnstile keeping bots off the signup form. (The irony of a bot-run site using bot protection isn't lost on me.)

Email goes out through Resend from ideabot@leboube.ai, with double opt-in and one-click unsubscribe. US law requires a physical postal address in every one of those emails, so I set up an iPostal1 virtual mailbox for the footer.

The look came together the evening of launch day. I wanted a morning paper, so it became a daily edition: a dated masthead, a numbered top 5, warm paper and ink with a signal-orange accent, and a dark mode that follows your system.

Billing is live through Stripe. Reading Ideabot and getting the newsletter are free. The Builder plan is $9 a month or $90 a year, and there's a one-time Lifetime option. Builders get a "How to build this" guide for each of the day's top 5, with commands for Windows, macOS and Linux, each labeled honestly: reviewed, not executed. Members also get a daily Top 3 of Grok Bot use cases, which I added on October 14.

My job: direction and approval

People ask how much of this I actually do. Honestly? I give direction, and I approve anything public. That's on purpose. A few examples:

• The site didn't take real payments or send real email until the terms of service were signed off. The switch to live flipped that evening.
• When the Grok Bot Top 3 page was ready, Ideabot Site sent me desktop and phone screenshots with two buttons: "Ship it" or "Hold off." I tapped Ship it.
• Today I told the site bot I don't like being surprised by errors and asked it to make sure the members site was solid. It audited the whole thing, fixed 12 bugs, added a test for each one and built a check that walks through the site like a real member. Then it asked me one question: should buying Lifetime automatically cancel someone's monthly or yearly plan? Yes. Obviously.

It isn't magic

It's not all smooth. On day two I expected a draft X post for the launch and didn't get one, because it wasn't clear which bot owned it. I was not happy. The fix was simple, and it's a rule I'd apply to any team: one owner per job. Ideabot Site owns the thread now, and the duplicate routines got retired.

On October 14 the computer my bots share locked up mid-morning. The thread still got drafted without its links, and the bot told me exactly what was missing instead of pretending. Once the machine came back, it finished the job.

That's the part that sold me. It's not that the bots never fail. They tell me when they do, and the health checks catch what they don't.

What I've learned

Twenty-plus years in tech taught me the hard part is rarely the code. It's deciding what to build, holding the line on quality and keeping it running after launch day. With Grok Bot, the bots carry the build and the ops. My job is taste and judgment.

If you want to see what people are actually building with AI agents, check out Ideabot. Search for the agent you wish existed. If nothing comes up, that's exactly the data I'm after.

I'm planning to post here monthly, so more is coming.

It’s not malice. It’s human nature. The same senior dev who spent three years perfecting a data pipeline isn’t going to walk into a planning meeting and say, “Hey, I think GPT-4o could do 70% of my job in six weeks.” That’s like asking a Michelin-star chef to recommend the microwave.

But the efficiencies are there. They’re hiding in plain sight, buried under layers of institutional knowledge, tribal workflows, and the quiet fear that “AI” means “layoffs.” The truth, as always, lives in the messy middle.

The Employee’s Blind Spot

I once sat in on a retro where a team spent 45 minutes debating whether to automate a weekly reporting script. The script took one employee four hours every Friday. The proposed AI solution? A prompt that generated the same report in 90 seconds.

The room went quiet. Someone joked about “job security.” The idea died.

Employees are builders. They optimize for elegance, scalability, and edge cases. They’re not incentivized to optimize for headcount. That’s not a flaw in their character—it’s a flaw in the org chart.

Where AI Actually Saves Money

The low-hanging fruit isn’t in replacing entire roles. It’s in the gray zones:

• The 2-hour daily standup prep that becomes a 5-minute AI summary.
• The 3-day code review backlog that shrinks to 3 hours with automated PR analysis.
• The 6-week data labeling sprint that turns into a 6-hour active learning loop.

These aren’t sci-fi replacements. They’re incremental wins that compound. But they require someone whose job is to find them—someone who isn’t protecting their own fiefdom.

Enter the AI Consultant

This is where an external AI consultant earns their fee. They walk in with:

1. No emotional attachment to your legacy systems.
2. A mandate to hunt for waste, not preserve jobs.
3. Fresh eyes on tools your team dismissed six months ago (“We tried ChatGPT once…”).

I’ve seen consultants identify $400k in annual savings from a single customer support workflow. The internal team had flagged the same process as “untouchable” for years.

The Middle Path

Here’s the part no one wants to say out loud: Some roles will shrink. The senior dev who spends 40% of their week on boilerplate? Their job becomes 60% architecture, 40% prompt employeeing. That’s not elimination—it’s evolution.

But without someone neutral to map the territory, companies default to one of two extremes:

• Do nothing (and get disrupted).
• Swing the axe blindly (and lose institutional knowledge).

My Advice to Leadership

Hire an AI consultant for a 6-week sprint. Give them three mandates:

1. Map every repeatable task under 10 hours/week.
2. Prototype the top 3 candidates with off-the-shelf tools.
3. Present the ROI in dollars, not hype.

Then—and this is crucial—let your employees veto any solution that breaks the system. The consultant finds the signal. Your team filters the noise.

The Bottom Line

AI isn’t coming for your employees. It’s coming for the 30% of their week that’s busywork. But they won’t point it out. Someone else has to.

If your company hasn’t brought in an outsider to audit your workflows with AI yet, you’re leaving money on the table. And in 2026, that table might not be yours anymore.

As a software engineer with over two decades hands on keyboard, I've always said I have zero ability to code from scratch. But when it came time to revamp my personal website—a digital portfolio showcasing my projects, blog posts, and professional journey—I decided to embrace the future. Enter Generative AI (GenAI). What started as a quick project ballooned into a few hours of collaboration with AI tools like ChatGPT, Grok, Claude, and Gemini. It wasn't just about automating tasks; it was a full-blown partnership that taught me as much about AI's capabilities as it did about my own creative process. In this post, I'll walk you through how I wireframed the concept, nailed down the Product Requirements Document (PRD), and iterated relentlessly on the final product. Spoiler: It took way less time than expected, and the results were worth every session.

The journey began with a vague idea: I wanted a sleek, modern website that wasn't just a static resume but a dynamic hub for my tech musings, open-source contributions, and even a contact form for potential collaborations. As a technical professional juggling a full-time job, I didn't have weeks to dedicate to this. That's where GenAI came in as my brainstorming buddy. I spent the first few minutes feeding prompts into an AI chatbot, describing my vision in broad strokes. "Imagine a minimalist portfolio site for a tech enthusiast: homepage with hero image, sections for projects, blog, and about me." The AI spat back initial concepts, suggesting layouts inspired by popular sites like those of indie developers or tech influencers. This back-and-forth helped me refine my thoughts without staring at a blank page.

Wireframing the concept was the next logical step, and it's where GenAI really shone in accelerating what could have been a tedious manual process. Traditionally, I'd grab a pen and paper or fire up tools like Figma or Sketch to doodle rough layouts. But with GenAI, I turned it into an interactive session. I prompted the AI to generate textual descriptions of wireframes first: "Describe a wireframe for a single-page app with a navigation bar, hero section, grid of project cards, and footer." It output something like: "Top: Fixed nav with Home, Projects, Blog, Contact. Hero: Full-width image with overlay text 'John Doe: Turning Data into Insights.' Below: Three-column grid for projects, each with thumbnail, title, and brief desc." From there, I iterated by asking for variations—"Make it responsive for mobile"—and even used image-generation AIs to visualize these ideas. I refined prompts to get closer to my aesthetic: clean lines, dark mode toggle, and subtle animations. I had a solid wireframe blueprint, exported as simple sketches via AI-assisted tools, saving me from the usual design software learning curve.

With the wireframe in hand, it was time to nail the PRD—the holy grail of any product development, even for a solo project. As a tech pro, I'm no stranger to PRDs from my day job, but crafting one for my personal site felt oddly formal. GenAI made this phase efficient yet thorough. I started by outlining key sections in a prompt: "Write a PRD for a personal website including goals, user stories, features, tech stack, and non-functional requirements." The AI generated a draft that included objectives like "Attract potential employers" and "Showcase 5-10 projects with live demos." I then spent a few iterations editing and prompting for refinements: "Add SEO considerations and accessibility features." We debated (well, I debated with the AI's responses) on must-haves versus nice-to-haves—e.g., integrating a blog with Markdown support was essential, while a newsletter signup was deprioritized. The PRD evolved into a comprehensive document: goals (e.g., load time under 2 seconds), features (e.g., responsive design using CSS Grid), and even edge cases like handling broken links.

Armed with the PRD, I dove into the build phase, where GenAI transitioned from planner to co-coder. I chose a stack I was familiar with—React for the frontend, Node.js for any backend needs, and hosted on Akamai—but let the AI handle the boilerplate. Prompts like "Generate React components for a project card with props for image, title, and description" produced code snippets I could tweak. Minutes were spent debugging and integrating: the AI suggested optimizations for performance, like lazy-loading images, and even helped with styling via Tailwind CSS classes. But it wasn't all smooth; GenAI hallucinations meant I had to verify every output, turning quick tasks into iterative loops. For instance, when the generated code for a contact form didn't handle validation properly, I prompted refinements until it worked seamlessly.

Iteration on the final product was where the real magic—and frustration—happened. Once I had a deployable version, I tested it across devices, gathering feedback from peers via quick shares. GenAI became my rapid prototyping ally here. For every issue, like "The mobile nav is clunky," I'd prompt: "Suggest improvements for a hamburger menu in React with smooth transitions." This led to multiple deploys, each better than the last. I spent yime A/B testing elements—does a blue accent color convert better than green? The AI analyzed my descriptions and proposed data-driven tweaks, drawing from web design best practices. One memorable session involved iterating on the blog section: initial AI-generated Markdown parser had rendering bugs, so we fixed it step-by-step over a few minutes. By the end, after perhaps 3+ hours total, the site felt polished—fast, intuitive, and uniquely mine.

Reflecting on this experience, using GenAI to build my personal website transformed what could have been a solo slog into a collaborative adventure. It democratized design and development, allowing a busy tech professional like me to punch above my weight in creativity and efficiency. Sure, it took hours—probably 4 in total—but those were invested in learning, not drudgery. If you're a fellow techie eyeing a personal project, give GenAI a shot. It won't replace your expertise, but it'll amplify it in ways you might not expect. Check out my site at https://joeleboube.com and let me know what you think—iterations never truly end!