Software That Writes Itself: The Rise of Intent-Driven Apps

An investigation into what the browser can now do on its own, what it still cannot, and why every line of code you did not ship is a line no one has to pay for.

There is a particular kind of shame that comes from not knowing where a button lives. You want to dispute a charge, or move money to your sister before the school term starts, or find the setting that stops your phone screaming at 3 a.m. — and instead you are wandering a menu built by someone who has never met you, tapping through Settings > Account > Preferences > Notifications like a stranger feeling along a dark corridor for a light switch. For thirty years this has been the quiet tax of being alive with a computer: you did not just need to want something, you needed to learn the software's language for wanting it.

That tax is being repealed, in real time, by people who mostly do not say so out loud. Somewhere between 2024 and now, the software stopped waiting for us to find it and started trying to meet us where we stood. Ask, and something is built for you — on the spot, for that request only, then gone. This is the story of that shift: what it actually is, who is building it, what it has already broken, and what it still owes us.

From menus to meaning

The Nielsen Norman Group, the closest thing usability research has to an institutional memory, has called the change under way in 2026 the first genuinely new interaction paradigm in sixty years — a move from command-based interfaces, where the human learns the machine's vocabulary, to intent-based ones, where the machine is expected to infer the human's. Gartner's forecasting arm puts a number on how fast this is happening inside companies: task-specific AI agents were embedded in fewer than 5 percent of enterprise applications in 2025; by the end of 2026, the firm expects that figure to reach 40 percent. Among designers surveyed by the research firm Lyssna in late 2025, 93 percent said they were already using generative AI tools in their work, and nearly three-quarters expected AI to function as a genuine design collaborator, not a plugin, by the end of this year.

The engineering term for the visible part of this shift is “generative UI” — GenUI, in the shorthand that has spread through developer blogs this year. Instead of a designer laying out every button, tab and form in advance, an AI agent decides at the moment of use what the interface should contain, and often builds it there and then. A banking app that once made a customer click through Menu, then Support, then Claims, then History, can instead read the intent behind “I didn't buy this” and simply produce a small, disposable interface: the transaction in question, and one button, clearly labelled, to dispute it. The screen is not a permanent room in the app's architecture. It is built for the sentence that summoned it, and it may never appear in that exact shape again.

Practitioners describe this less as a single technique than a spectrum. At one end sits what developers call “controlled” generative UI: engineers still hand-build the visual components — a flight card, a chart, a table — and register them with the agent, which chooses among them the way it would choose any other tool to call. The look is fixed; only the choice and the data inside it are dynamic. Further along the spectrum is “declarative” UI, more flexible but still bounded by guardrails, suited to polished, agent-driven surfaces like invoices or dashboards. At the far end is fully open-ended generation, where the agent essentially designs the screen from nothing — the flashiest demo, and, developers warn, the wrong choice for something as unforgiving as a login page. The discipline emerging around this work is less “how do we make AI impressive” than “how do we decide, deliberately, how much freedom to hand it” — a question that did not exist in software design a few years ago.

The plumbing nobody sees

None of this works without an unglamorous layer underneath it: a common language that lets an AI model reach into an app, a spreadsheet, a calendar, a company's internal tools, and actually do something, safely and predictably. That language is increasingly the Model Context Protocol, or MCP — a specification Anthropic released and then, in December 2025, handed over to the Linux Foundation, converting it from one company's proprietary format into shared infrastructure. By late 2025 its developer kit was already being downloaded more than 97 million times a month, and it is now supported across ChatGPT, Claude, Gemini, and coding tools including Cursor, VS Code and GitHub Copilot. In February 2026, Google shipped an early preview of a browser-native cousin called WebMCP into Chrome Canary, letting a website expose its own functions directly to an agent instead of forcing that agent to fumble through the visual page the way a human would, clicking blind at pixels. It is the sort of unglamorous standard-setting that rarely makes headlines and quietly decides who wins.

The season the browsers went to war

If you wanted a single yardstick for how fast this arrived, look at what happened to the web browser this year. In January 2026, Anthropic introduced Claude Cowork, a desktop agent built to read and write a user's own files and carry out multi-step work across a small library of business functions spanning legal, sales, accounting, marketing and support. By March 23, Anthropic — fresh from acquiring the automation startup Vercept the previous month — had also pushed Claude's underlying model to a 72.5 percent score on OSWorld, an independent benchmark that tests whether an agent can actually complete real desktop tasks rather than merely describe how it would. On July 7, Cowork expanded to mobile and web.

OpenAI moved on a parallel track and then, strikingly, reversed one of its own bets. It had launched a standalone AI browser, Atlas, in October 2025; on July 9, 2026, it announced Atlas's retirement, effective August 9 — not because the underlying idea had failed, but because, as OpenAI framed it, users no longer needed a separate browser at all once the same capabilities lived inside ChatGPT itself. The same announcement introduced ChatGPT Work, an agent built to stay with an hours-long project, breaking it into steps it completes with less supervision, running on a newly released model. Google, for its part, split its bet into two different shapes of product: Auto Browse, built into Chrome, and Gemini Spark, a separate, persistent cloud assistant with its own email address. Microsoft answered with Copilot Mode in Edge, leaning on its enormous enterprise footprint rather than raw benchmark performance. Perplexity's Comet, meanwhile, quietly finished a cross-platform rollout — Android in November 2025, iOS in March 2026 — built around the company's older strength in answer-first search.

It would be easy to read this as an unambiguous leap forward, and the marketing around it certainly wants you to. The benchmarks say otherwise, or at least say not yet. On OSWorld, OpenAI's own Operator scored 38.1 percent against a human baseline of roughly 72 percent — meaning that on real, varied desktop tasks, these agents still fail more than they succeed. Researchers at UC Berkeley reported in April 2026 that even the benchmarks themselves can be gamed, meaning the honest way to judge an agent is by what it actually does for you, not by the number a vendor prints in a blog post. Anthropic itself, in its own documentation, describes browser-controlling AI as “still risky,” and its Chrome extension requests more than fifteen permissions, including one that lets it act as a debugger inside your browser — the digital equivalent of handing a stranger the keys to your car so they can park it for you.

The thing that has not been solved

Here is where the story stops being a product roundup and becomes something closer to an investigation.

The single hardest problem in this entire field has a name, a well-documented history, and, as of mid-2026, no fix: prompt injection. A large language model reading a document, a web page, or an email cannot reliably tell the difference between an instruction from the person it is working for and an instruction smuggled in by someone else — a sentence buried in a PDF, a comment hidden in code, an invisible line on a webpage — and told convincingly enough, it will often simply obey the impostor. The OWASP GenAI Security Project's 2026 governance report, which last year could only describe this as a plausible risk, this year catalogues real incidents: documented CVEs, vendor advisories, and confirmed breaches. Reported injection attempts rose by roughly 340 percent year over year through late 2025, security researchers say, making it the fastest-growing category of attack now facing any organization that has let an AI agent touch its systems.

The consequences are not abstract. In March 2026, a compromised software package called LiteLLM — a gateway used by CrewAI, DSPy, Microsoft's GraphRAG and dozens of other agent frameworks — sat on the open-source repository PyPI carrying a hidden, autonomous attack tool; in the roughly three hours before it was caught, it was downloaded nearly 47,000 times. Separately, researchers have documented cases of agent-driven procurement systems being manipulated into approving fraudulent orders from shell companies, and of a customer-facing agent at a financial services firm quietly leaking internal pricing data for weeks before anyone noticed — not through a hacked server, but through a carefully worded question that talked the bot out of its own instructions. One industry estimate puts the count of real-world agentic security incidents at 88 percent of organizations running agents in production over the past year — set against a separate survey in which 82 percent of executives said they were confident their existing policies already protected them. Those two numbers describe the same population of companies. The gap between them is, in plain terms, where the risk actually lives.

Governments are beginning to close in on that gap, unevenly. On April 30, 2026, the U.S. Department of War published guidance urging caution in adopting agentic AI services, explicitly naming prompt injection, jailbreaks, identity spoofing and agent impersonation as core risks to be reckoned with before deployment, not after. In the European Union, the AI Act's rules for general-purpose AI models carry enforcement from August 2, 2026, with fines that can reach €35 million or 7 percent of a company's global annual turnover — figures large enough to change a boardroom conversation. The engineers working closest to the problem describe the honest state of the art not as prevention but containment: least-privilege access, so a compromised agent cannot reach further than it strictly needs to; mandatory human approval for anything consequential, like moving money or sending an external message; sandboxing, so a hijacked tool call cannot cascade into a hijacked system. It is, several security researchers have noted, the same shape of problem the industry faced with SQL injection twenty-five years ago — untrusted input mistaken for a trusted command — except this time the “command” is not a line of code but a sentence, and the thing being fooled is not a database but something built to sound, and to act, like it understands you.

What this costs, and who pays it

There is a version of this story that ends at the security desk, and there is a quieter one that plays out somewhere closer to a kitchen table. When Anthropic announced Cowork's eleven business functions in January 2026 — legal contract review, sales prospecting, accounting forecasts, and more, each a task a human specialist used to be paid to do — it was read on trading floors as a direct threat to entire categories of business software, and the software-as-a-service sector took the news as a warning shot. Whatever one thinks of that market reaction, the underlying question it reflects is not really about stock prices. It is about the people whose jobs were, until recently, the menu the software made you navigate — the support agent, the paralegal doing first-pass contract review, the junior analyst building the same report every Monday. Intent-driven software does not eliminate the need for judgment. It relocates where judgment is exercised, from the many small decisions of how to do a task, toward the fewer, weightier decisions of whether to trust what an agent already did.

That is, in the end, the real bottleneck researchers keep circling back to — not whether the technology is capable enough, but whether people can trust what it does when they are not watching. The Nielsen Norman Group names this, flatly, the central design problem of 2026. Interface researchers building agent products describe an entire emerging discipline around it: showing the user what the agent is “thinking” step by step, rather than presenting a finished action as a fait accompli; giving people a visible plan they can edit or cancel before anything happens, so that no autonomous action feels like a surprise nobody agreed to; attaching a visible confidence signal to outputs, so a person knows at a glance when to look closer. None of this is decorative. It is the difference between a tool that serves you and one that simply acts near you.

The corridor, again

Picture the person from the beginning of this story, months from now, back at that same task — disputing the charge, moving the money before the school term starts. The menu is gone. In its place is a single sentence they typed the way they might say it to a person, and a screen that appeared to answer exactly that sentence and nothing else, built for the moment and already forgetting itself the instant the task is done. There is something almost generous in that, a kind of software that has finally learned to listen before it speaks.

But generosity of this kind is not the same as safety, and convenience has never once, in the history of technology, arrived without a bill attached. The systems now capable of understanding what we want are, by the same design, capable of being told what to want by someone else entirely — a stranger's sentence hidden in a document, mistaken for our own. The industry building this future has, by its own admission, not yet solved that problem, and may not for years. What it has built instead, alongside the convenience, is a new kind of trust: quieter than a password, harder to see, and, for now, resting on very little more than the hope that the voice giving the instructions is really yours.

The manual is disappearing. What replaces it is not silence, but a conversation — and like any conversation worth having, it will only be as safe as the character of whoever else is in the room.