Yesterday I was on the WP-Tonic podcast, and my colleague Adrian Laboş did a great summary of the key points, which I’ll share here:

AI security audit wave incoming: Expect AI tools to flood WordPress core and the 70,000+ plugin ecosystem with both improvements and newly discovered security vulnerabilities, requiring infrastructure to triage at scale.

Avoid vibe-coding compliance surfaces: For payments, fraud, and regulated commerce flows, prioritize battle-tested WooCommerce and vetted extensions over bespoke AI-generated code.

Reposition plugins around durable differentiation: If AI collapses “nice-to-have” features (e.g., basic image manipulation), shift value to workflow ownership, integrations, compliance, performance, and support.

Agencies gain leverage, not obsolescence: AI tools give motivated technical people 10-100x capability increases, meaning agencies can serve existing clients far better rather than being replaced by DIY site builders.

Sell outcomes, not hours, as an agency: Client expectations will compress delivery timelines; adapt pricing to value-based packaging and use AI internally to raise throughput and QA coverage.

Design for agentic usability: Strengthen APIs, WP-CLI, and machine-friendly interfaces so personal agents can safely operate WordPress tasks without brittle UI automation.

WordPress Playground enables AI verification: Spinning up fully containerized WordPress instances in 20-45 seconds inside browsers allows AI to test code across 20+ environments simultaneously, fundamentally changing plugin compatibility testing.

Benchmark AI outputs against WordPress-specific evals: Adopt WordPress block, plugin, and site-generation evaluations to catch “small file” failures (readme, headers, packaging) that break deployments.

Prioritize compatibility testing by real-world co-install patterns: Reduce factorial plugin-combination risk by sampling tests based on which plugins are commonly used together and automating those paths.

Plugin directory needs editorial curation: With submissions accelerating toward 100,000+ plugins, WordPress will introduce editorial spotlights on newer plugins with excellent code/design to balance discoverability with marketplace openness.

Improve plugin discoverability without freezing innovation: Curate “trusted” and “high quality” signals while preserving pathways for new entrants to earn distribution through measurable excellence.

Plan for uneven economic diffusion: Even with today’s models, enterprise adoption lags consumer usage; build internal enablement and governance now so teams can scale impact as tooling matures.

Learning to learn beats domain expertise: When advising students/parents, the most future-proof skills are curiosity-driven learning, command of language, and study of classics/philosophy/ethics rather than specific technical domains.

WordPress 7.0 promises AI integration: The upcoming release will feature “lots of fun AI stuff” and represents one of the most exciting technology years in Matt’s career since starting in the industry.

I had no idea that today Anthropic would release their security thing that does exactly what I said.

The best thing you’ll read about AI engineering today is Chris Lattner’s take on Claude’s C compiler implementation. To steal Techmeme’s headline: “Claude’s C Compiler shows AI elevates the role of human judgment and vision; it’s a milestone, but closely mirrors LLVM/GCC, and hard codes things to pass tests.” The entire post is important, but this paragraph is particuluarly profound:

As writing code is becoming easier, designing software becomes more important than ever. As custom software becomes cheaper to create, the real challenge becomes choosing the right problems and managing the resulting complexity. I also see big open questions about who is going to maintain all this software.

To bring this back to WordPress: While I was in another meeting today, Claude Code with Opus 4.6 completed a cleanroom implementation of the ACF plugin in about 45 minutes. It was about to go off and implement all the pro features, but I stopped it because it would be a tremendous waste of tokens. The entire point of open source is collaborating on a shared goal rather than reinventing the wheel every time.

We’ve seen a slow version of this play out over the past decade, where every single web host that offers WordPress also spun up some sort of proprietary website or ecommerce builder. Bless their hearts. None has caused Shopify any lost nights of sleep. With countless person-years of development and who knows how many tens or hundreds of millions of dollars spent, I think we can now safely say that all of these efforts have had at most a marginal impact on their businesses, while the benefits of WordPress have continued to compound.

The thought experiment of whether those same resources had been used to make WordPress better is left as an exercise for the reader.

It does mean that competition is fiercer. You have to differentiate yourself on performance, customer service, reliability, design—things that are hard, but that’s capitalism.

It’s really important that in the plugin directory, we figure out how to make it easier for people to collaborate and build things together, rather than make a thousand versions of the same thing.