# Should You Replace Your Software With One AI Built? List Its Hidden Jobs First

- Author: Melissa Kolbe (https://pallasadvisory.com/about/)
- Publisher: Pallas Advisory (https://pallasadvisory.com)
- Published: 2026-10-27
- Category: Strategy (https://pallasadvisory.com/blog/strategy/)
- Canonical: https://pallasadvisory.com/blog/build-vs-buy-hidden-jobs/
- Description: AI can now build your own version of most software you pay for. I moved my blog off WordPress.com to a site Claude Code built, then found out what my old plan had been doing for me all along. Before you cancel anything, list the vendor's hidden jobs, because every homemade tool comes with one person on call, playing every part the subscription used to cover.
- TL;DR: Building your own version of software you pay for got cheap. Doing the vendor's hidden jobs did not. My hosted WordPress.com plan kept PHP up to date for me, and that was part of what I paid for. Build only when the job list is short, someone else carries the hardest item, and you can check it fast.

---

*Building your own version got cheap. Doing the jobs the vendor did while nobody was looking did not.*

[REA](https://github.com/morluto/rea), a project on GitHub (where developers share code), has collected more than 380,000 stars, and according to a [write-up by Itai Spector](https://medium.com/@itaispector1/oh-boy-another-ai-trend-has-landed-rea-reverse-engineer-anything-300k-gh-stars-in-10-days-110cf9f1b75c), a developer who writes about AI tools, most of them arrived in about ten days in October 2026. REA hands an AI coding agent the professional tools for taking software apart. Its pitch: see a feature in someone else's app, ask your agent how it works, and get a version for your own project.

The stars aren't really about the tool. They're about a feeling every small business owner with a credit card statement already has. Spector puts it well: he doesn't need all of Premiere, Adobe's video editor, he needs maybe fifteen percent of it. Multiply that by every subscription you pay for monthly and you get a lot of people wondering whether to cancel everything and have an agent build the slice they use.

Spector's answer is a good filter, and I'll borrow it with credit. Cloning works when the target is small, doesn't change, and has a cheap way to check that the copy behaves like the original. His conclusion is that generating software got cheap and verifying it didn't. I agree, and I've written the [verification half of this argument before](/blog/ai-second-brain-verification/).

In March 2026 I argued that building your own [now costs less than the subscription](/blog/ai-agent-products-saas-conformity-tax/). It does. This post is about the bill I left out: the half that shows up after the copy works.

## I did this seven weeks ago

On September 6, 2026, I moved this blog off WordPress.com (Automattic's service that hosts the free WordPress software for you) and onto a site built by Claude Code, Anthropic's AI coding agent, in a repository I own, hosted on Vercel (which runs the servers), where publishing a post means pushing a commit. WordPress had started to feel bloated for what I needed, and on a site I own, my AI tools work on the code directly, so I can try more interesting things. It's more flexible, and financially it made sense. I'm not a developer. Since the move, upkeep has been simple.

So far, a clean "build" story. Then the PHP news landed.

## The flaw I didn't dodge

On October 21, 2026, [WordPress warned site owners](https://wordpress.org/news/2026/10/critical-php-security-release/) that PHP, the language WordPress runs on, had released fixes for two critical vulnerabilities. It told them to update immediately, and told anyone running an old version on their own hosting to consider taking the server offline while they prepared to update.

My first reaction was relief: good thing I left. Then I checked what plan I had actually been on, and the relief turned into a better lesson.

My old blog was on a hosted WordPress.com plan. [WordPress.com's support page](https://wordpress.com/support/hosting-configuration/) is plain about it: when a PHP update is required, "WordPress.com updates it for you." I was never in the group that had to scramble. Not because I'd moved. Because I'd been paying someone whose job that was.

That is the part of a subscription nobody puts on the pricing page. Spector says it in one line about Adobe: what you pay for "was never really the code. It was the guarantee."

## Every subscription hides a list of jobs you'd inherit

So I wrote down what my old vendor did for me without being asked, and who does each job now.

| Job the vendor did quietly | On WordPress.com | Now |
|---|---|---|
| Patching the server and PHP | WordPress.com | No PHP and no server of my own: the site is plain pages, and Vercel runs the servers |
| Updating the software the site runs on | WordPress.com, automatically | Me, when GitHub's automated checker proposes an update. Two so far, and I approved both |
| Keeping every post | Inside WordPress.com's database | Every post is a plain text file in my own repository |
| Publishing a scheduled post on time | Built in | A small script Claude Code wrote |
| Old links still working | Not needed | Me: a redirect site that has to stay up until I shut it down by early December 2026 |
| Holding the domain name | WordPress.com | Still WordPress.com. I kept that job with the vendor on purpose |
| Noticing when something breaks | WordPress.com, then me | Me |

Two things made my list easy. It was short. And the hardest item, keeping servers patched and running, still belongs to someone else. I didn't replace my vendor. I replaced the part of my vendor I can check in seconds: does the page load, does the link go where it should.

That's Spector's filter again, applied to ownership instead of copying. My site is small, it holds still between my posts, and I can tell in seconds whether it works.

## You had no legacy. Don't build yourself some.

In October 2025 I argued that a small business's [one real advantage over an enterprise](/blog/smb-ai-advantage-workflow-redesign/) is that it has no legacy systems to defend. No eight-figure CRM customization, no seven departments depending on a database nobody understands.

Every tool you build in 2026 is a 2028 legacy system with exactly one person on call.

The risk isn't a bad build. AI builds can be good. The risk is a good build nobody owns. The homemade booking tool works beautifully until the person who prompted it moves on, the calendar service it talks to changes how it logs in, and the first sign of trouble is a customer asking why their appointment vanished. Nobody did anything wrong. The vendor's invisible job just stopped being anyone's job.

## Four questions decide whether to build or keep paying

Answer these on paper before anyone builds anything.

1. **What does this tool do when nobody is looking?** Patches, updates, backups, keeping up with new rules, keeping its connections to other tools alive. Search the vendor's help pages for words like "automatically" and "for you". That's where the invisible jobs are written down.
2. **Who does each item after you build?** A person's name. "The AI" is not an answer, because the AI does what someone asks, when someone asks.
3. **How will you find out it stopped working?** If the honest answer is "a customer tells us", the tool fails this question.
4. **Where does your data go if nobody maintains it?** Plain files you can open somewhere else pass. A database only the homemade tool understands doesn't.

Then the decision:

- **Build** when the list is short, someone else still carries the hardest item (a host that runs the servers, say), and you can check that it works in seconds. Internal dashboards, calculators, a booking page, often your website.
- **Keep paying** when the list is long or the jobs change on their own. Invoicing and payroll follow tax rules that the Belastingdienst (the Dutch tax office) and the IRS update without asking you. Email sending lives on deliverability work you never see. Anything that takes card payments or holds your customers' personal data carries security and legal jobs that are the whole reason the subscription exists.

## Reverse-engineering tools are untrusted code until you read them

If you go exploring: a tool from a [pseudonymous developer](https://medium.com/@itaispector1/oh-boy-another-ai-trend-has-landed-rea-reverse-engineer-anything-300k-gh-stars-in-10-days-110cf9f1b75c), [installed with one command](https://github.com/morluto/rea#quick-start), running with everything your agent can touch, is [the exact profile I wrote about in August 2026](/blog/wouldnt-run-strangers-exe-agent-skills/). Curiosity is fine. Read what you're installing first.

## The real question is who does the vendor's job now

"Can AI build our own version?" now has an easy answer, which makes it the wrong question. The useful one is the one I should have asked before feeling relieved about the PHP news: what was the vendor doing that I never saw, and who does it now?

My list was short, so I built. Write yours before you cancel anything.

## FAQ

**I've already built a replacement and cancelled. What now?**
List what the old vendor did for you without being asked, put a person's name next to each job, and set up the cheapest way you'll hear when something breaks. Then check where your data lives: if only your homemade tool can read it, export it to plain files now, while the tool still works.

**Does keeping part of the old vendor count as failing?**
No. I kept my domain with WordPress.com on purpose. The goal isn't to replace every vendor. It's to know which jobs you kept, which you took on, and who does each one.

**What if the vendor's help pages don't say what they do automatically?**
Ask support in writing: what do you update, patch or back up for me without my doing anything? A vague answer tells you something too: you'd be discovering the list after you cancel.

## Sources and Further Reading

- [Oh Boy, Another AI Trend Has Landed: REA, Reverse Engineer Anything (300K GH Stars in 10 Days)](https://medium.com/@itaispector1/oh-boy-another-ai-trend-has-landed-rea-reverse-engineer-anything-300k-gh-stars-in-10-days-110cf9f1b75c), Itai Spector, Medium, October 18, 2026
- [Critical PHP Security Release](https://wordpress.org/news/2026/10/critical-php-security-release/), John Blackbourn, WordPress News, October 21, 2026
- [Access your WordPress.com server settings](https://wordpress.com/support/hosting-configuration/), WordPress.com Support, last reviewed October 20, 2026
- [morluto/rea](https://github.com/morluto/rea), GitHub (387.4k stars, 97.0k forks as read October 26, 2026)