# Gadgets: Personal app vibe coding that is actually safe Kenton Varda, Cloudflare | AI Engineer World's Fair 2026 | 18:54 Source: https://www.youtube.com/watch?v=RmS5s6Wbin4 Channel: AI Engineer (https://www.youtube.com/@aiDotEngineer). Summarised by AIE Talks. Page: https://aietalks.com/talks/gadgets-personal-app-vibe-coding-that-is-actually-safe Published: 2026-08-05 Tags: code-generation, computer-use, deployment, security ## TL;DR - Personal AI code generation needs infrastructure where users can change their own app instances. - Gadgets give each document its own app instance, with sharing and access control handled by the platform. - Sandboxed client and server code can make many bugs in AI-generated applications harmless. ## Summary Kenton Varda argues that personal AI code generation does not fit the standard cloud model. In that model, one developer-owned server runs one approved version of an app, so users cannot add features themselves. Feature requests either disappear into Jira or push the developer toward a long plugin-system rewrite. Varda presents Gadgets, a Cloudflare Workers-based environment where each document is an app instance that users can customize with an agent. A slide deck can ask Claude to modify its own app, adding strikethrough, centered text, or raw SVG support when the requested content needs it. Gadgets handles sharing at the platform level, while the client and server run in restricted sandboxes. The demo uses a null-origin iframe, Cap'n Web RPC, dynamic workers, and Durable Objects. Varda also explains that the system runs locally on workerd without containers or a database. The project was not open sourced at the talk because Cloudflare decided to release it more carefully. ## Key ideas ### Personal AI apps require a different cloud model [00:01](https://www.youtube.com/watch?v=RmS5s6Wbin4&t=1s) Varda's main claim is that personal AI code generation breaks traditional cloud infrastructure. He uses "personal" to mean that people can run apps and change them for their own needs. Today's software usually comes from a developer to users as a finished product. The infrastructure reinforces that arrangement because one approved version runs on the developer's server for everyone. If users are going to personalize apps with agents, Varda says the underlying system must allow each person's version to diverge without turning the main codebase into a collection of special cases. ### Feature requests either disappear or damage the codebase [01:16](https://www.youtube.com/watch?v=RmS5s6Wbin4&t=76s) Users ask developers for features that matter to their own use cases. Product managers file many of those requests in Jira, where Varda jokes that they are "never seen again." The requests that do get accepted add conditional logic to the application, even though each feature may help only a small group. Developers then face a messier codebase and often propose a rewrite with a plugin system. That creates another delay: new requests are rejected because the plugin architecture is supposedly needed first. Years can pass while neither the rewrite nor the requested features arrive. ### Agents could add local features without burdening every user [03:27](https://www.youtube.com/watch?v=RmS5s6Wbin4&t=207s) Varda proposes giving users the first version of an app and letting their own AI agent add missing features when needed. Each user could get the behavior required for their work, while the developer keeps the core application smaller. The feature does not need to become part of the official product, and users do not have to wait for a roadmap decision. This idea depends on letting users run modified code safely, which existing mobile and cloud platforms do not support well. ### The web permits user code, while cloud hosting still centralizes control [05:11](https://www.youtube.com/watch?v=RmS5s6Wbin4&t=311s) Apple and Google restrict unsigned software on mobile devices, so Varda points to the web as the practical place where people can build and run what they want. He rejects the claim that allowing arbitrary web software automatically creates a security disaster. The web has a different limitation: for roughly 25 years, cloud applications have generally run on the developer's server. Every user sends requests to the same blessed version. That keeps updates simple for developers, but it prevents users from customizing their own running copy. ### Gadgets are separate app instances inside an office-suite model [08:39](https://www.youtube.com/watch?v=RmS5s6Wbin4&t=519s) Varda asks people to think of Gadgets as an office suite rather than a place to deploy ordinary websites. Like Google Docs, it contains many items that users open, edit, and share. Each item is a Gadget, an application with its own code. Examples include a collaborative whiteboard, a tool for filtering Spanish email, and a GitHub pull-request sorter. Blueprints let someone export a Gadget's code without its data. Other people can use that blueprint to create their own instances, including document editors, kanban boards, and slide builders. ### The platform owns sharing because each Gadget contains one document [11:03](https://www.youtube.com/watch?v=RmS5s6Wbin4&t=663s) A Gadget instance is tied to one thing, such as one slide deck. Someone who wants several decks creates several instances. Since each instance is independently shareable, the platform can provide the sharing dialog, links, collaboration, and access control. The application does not need to implement those rules itself. Varda says this design prevents the Gadget from getting access control wrong, because the app does not own the general sharing model. ### Claude changed the slide app while creating the presentation [12:21](https://www.youtube.com/watch?v=RmS5s6Wbin4&t=741s) Varda gave Claude a link to a Google document describing the slides and told it to add features to the slide app if necessary. Claude read the app's code and found that it needed strikethrough formatting and centered text. It also added a box accepting raw SVG so it could create a cloud diagram that the app's existing boxes and arrows could not express. The SVG feature was useful to Claude because the agent could generate the SVG directly, even though it would not be a convenient control for a human user. ### Sandboxing limits what an XSS bug can do [14:04](https://www.youtube.com/watch?v=RmS5s6Wbin4&t=844s) The Gadget UI runs inside a null-origin iframe with a content security policy. It cannot access cookies or communicate freely with the rest of the browser. Its only route is postMessage to the parent, which connects through a Cap'n Web RPC session to the Gadget's server code. That server code runs in a dynamic worker sandbox and is also blocked from contacting the rest of the world. Varda's claim is that a vibecoded client or server can still produce the Gadget's UI, but an XSS bug has nothing useful to leak because both sides are isolated. ### The system runs on Workers and workerd without containers or a database [16:22](https://www.youtube.com/watch?v=RmS5s6Wbin4&t=982s) Everything in the demo except the language model is built on Cloudflare Workers. Varda says the system uses dynamic workers and Durable Objects rather than containers and a database. The complete setup also ran locally on his laptop through workerd, the open-source runtime for Cloudflare Workers. That is why the failed internet request did not stop the demo. Since workerd can be self-hosted, Varda is considering running the system in his basement with Home Assistant and Spotify connectors for home automation. ## Notable quotes - "My key point is personal AI codegen breaks traditional cloud infrastructure." (00:01) - "We need something entirely different." (10:06) - "And so if you have an XSS bug, it actually doesn't end up mattering because these can't leak anything." (15:20) - "There are no containers involved here." (16:36) - "Sorry. That's not happening today. It will happen soon though." (18:02) ## Tools & references mentioned - Cloudflare Workers - Cloudflare workerd - Cloudflare - Claude - Jira - Apple - Google - Google Docs - Cap'n Web - Durable Objects - Home Assistant - Spotify - GitHub - Philip - Dne ## Who should watch - You are building AI-generated personal tools and need users to customize them without adding every request to the main product. - Your app has many independently shared documents or workspaces, and you want the platform to own sharing and access control. - You are evaluating sandbox designs for untrusted client and server code, especially where an XSS bug should have limited consequences.