Why this is in the vault
A first-person account of a non-engineer shipping a real security hole via vibe-coded MCP connector, and the "illusion of explanatory depth" framing for why AI's own explanation isn't verification — directly on-thesis for how Ray Data Co gates agent-built artifacts.
The core argument
Katie Parrott, a non-engineer "writer-builder" at Every, vibe-coded a personal app ("Tastemaker," a writing style-guide collector) with Claude Code during the Opus 4.5 / "agent-native architecture" wave (~Jan 2026). She added an MCP connector so coding agents could pull a user's style guide. An engineer friend warned that a backend agent managing access control is a different risk category than a normal authenticated API — she told Claude to "do the safe version," it built it, tests passed, she shipped it.
Weeks later, out of curiosity, she ran a newer model (GPT-5.6 Sol) against the same codebase. Sol found the live MCP connector had an open public registration route — an effectively unauthenticated entry point. No confirmed exploitation, but Sol recommended shutting it down; she did immediately.
Her diagnosis isn't "I'm not technical enough" — it's the illusion of explanatory depth: mistaking the ability to follow Claude's chain-of-thought explanation for having actually verified the work. She pairs this with testing research showing people default to happy-path testing over adversarial misuse cases, and frames the whole episode through OpenAI's "task crossover" concept (using AI to do work belonging to a different occupation's expertise) — citing an OpenAI finding that 16.8% of 800k+ sampled ChatGPT work messages involved task crossover. Her stated fixes: learn field fundamentals before building in it, get a human expert review for blind spots you can't see, and never let the AI's own reassurance be the sole safety signoff. She also hardened her AGENTS.md with new guardrails (the actual 5-step "pause before anything irreversible" prompt is paywalled).
No third-party sponsor; standard Every self-promo footer for its own tool bundle (Sparkle, Cora, Spiral, Monologue) and subscriber perks — not integrated into the argument.
Mapping against Ray Data Co
This is close to a case-study justification for the fresh-eyes critic architecture (verify-vault-write, verify-dispatch, verify-strategic-output, the not-yet-activated supervise skill) and the feedback_workflow_agent_output_integrity memory's "FALSE verified-against-primary-text stamps" failure mode: Parrott's mistake was accepting Claude's own explanation of its safety work as the safety gate, which is structurally identical to a producer-agent self-certifying its own artifact. The piece's actual catch mechanism — a second, different model auditing the first model's output with no stake in the original build — is exactly why RDCO routes verification through zero-context subagents rather than having the producing agent grade itself. Worth citing directly if the fresh-eyes-verification SOP ever gets a written rationale doc; it's an external, non-RDCO-authored data point for a pattern currently justified mostly by internal incidents (the May 31 fabrication, the 7 workflow-agent failure modes).
Related
- [[2026-06-08-every-guardrails-review-skills]]
- [[2026-04-20-every-ai-autopilot-verification-decay]]