73% of AI startups are just prompt engineering

Post by rs186 » Sat, Nov 29, 2025, 12:52 PM UTC

kllrnohj wrote: post #168

hn_throwaway_99 wrote: post #102

Earlier quoted context omitted.

> It sounds like some of these companies call the OpenAI or Anthropic APIs directly from their frontend. Which would be a major security hole. And sure, lots of startups have major security holes, but not enough that he could come up with these BS statistics. I'm a little dismayed at how high up this has been voted given the data is guaranteed to be made up.

> > It sounds like some of these companies call the OpenAI or Anthropic APIs directly from their frontend. > Which would be a major security hole. An officially supported security hole https://platform.openai.com/docs/api-reference/realtime-sess...

Realtime API is a very small use case that most products don't touch.

Post by [deleted] » Sat, Nov 29, 2025, 12:54 PM UTC

hn_throwaway_99 wrote: post #177

kllrnohj wrote: post #156

Earlier quoted context omitted.

I believe he's saying that a large number of the startups he tested did not have their own backend to mediate. It was literally direct front-end calls to openai. And if this sounds insane, remember that openai actually supports this: https://platform.openai.com/docs/api-reference/realtime-sess... Presumably OpenAI didn't add that for fun, either, so there must be non-zero demand for it.

It's a fair point that OpenAI officially supports ephemeral keys. But I still believe the vast majority of startups do wrapping in their own backend. Yes, I read what he's doing, and he's still only able to analyze client-side traffic, which means his overall claims of "73%" are complete and total bullshit. It is simply impossible to conclude what he's concluding without having access to backend network traces. EDIT:…

[deleted]

Re: 73% of AI startups are just prompt engineering

Re: 73% of AI startups are just prompt engineering