Vercel CEO: 60% of Deployments Now Done by AI Agents — Is SaaS Dead?

Vercel CEO Guillermo Rauch dropped a set of stunning numbers in a recent interview: at the start of the year, only 3% of deployments on the platform came from coding agents — today that figure has surged to 60%. Meanwhile, Vercel closed a $300 million Series F at a $9.3 billion valuation, with annualized revenue reportedly at $600 million. This interview is densely packed with insight, covering the state of AI coding, the future shape of SaaS, agent security, and the rise of open-source models — worth unpacking layer by layer.

From 3% to 60%: The Inflection Point for Coding Agents Has Arrived

Rauch offered a time comparison: Vercel took roughly 10 years to reach its first billion deployments, and then added another 1.5 billion in the following 10 months. Behind this acceleration, the proliferation of coding agents is the most direct driver.

"More and more, the world of software is robots telling other robots what to do," Rauch described the current state. Each deployment represents a change going live; agents are writing code, testing, and deploying at superhuman speed, and Vercel happens to be where that code lands. He observed that nearly every other post on X is a Vercel deployment, and giants like OpenAI and Meta are also using the platform.

What does this trend mean for developers? Rauch gave the example of his child doing math homework: he lets his kid use AI, but requires them to understand what the AI is doing. His call to "reject non understanding" sparked heated discussion on X — the core argument being: don't be the person who hits a button and ships code without looking at it at all. He compares his own current work to that of an engineering manager: reading code, asking AI to explain what it did, and verifying at critical points.

In the Age of Coding Agents, Where Is SaaS's Moat?

The most controversial take in the interview is Rauch's judgment on the future of SaaS. He believes the traditional "no code" era is ending, and that Vercel is a "yes code" company — coding agents drive the cost of code generation toward zero, letting enterprises generate software tailored to their workflows on demand. "When you buy the Vercel platform, you don't need to buy software anymore," he calls this a "lethal combination."

But this doesn't mean giants like Salesforce and SAP will disappear. Rauch's distinction is clear: software needs data, and systems of record — customer history, contacts, meeting notes, tickets — remain essential. What's changing is the mode of interaction, from "humans visiting interfaces" to "agents accessing data and generating interfaces." He described internal usage at Vercel: through an agent deployed on Slack, you can directly ask about a customer's deployment frequency and ticket status; the agent fetches data from Salesforce and generates a report, and the human never has to open Salesforce at all.

This "headless" trend corresponds to the rise of a new protocol layer. Rauch highlighted MCP (Model Context Protocol) in particular, which lets services declare to agents "which of my tools you can use." Vercel's MCP tells agents how to deploy software and how to list projects. There are also machine payment protocols and universal commerce protocols — Vercel has partnered with Stripe and Shopify to let agents complete transactions, and even purchase tools like browsers on marketplaces.

MCP (Model Context Protocol) is an open-source protocol standard proposed by Anthropic in late 2024, designed to let AI agents discover and invoke external tools and data sources in a unified way. It defines a client-server architecture: service providers (such as Vercel, GitHub, databases) implement MCP servers and declare available tools, resources, and prompt templates, and agents as clients can dynamically obtain these capabilities without writing separate integration code for each service. Compared to earlier function calling approaches, MCP's advantage lies in standardization and composability — a single agent can connect to any number of MCP servers, dramatically reducing integration costs. It's seen as the "USB interface" of the agent ecosystem, increasingly adopted by developer tools and enterprise platforms, and is the core of what Rauch calls the "new protocol layer."

Agent Security: The Most Underestimated Risk

The interview includes a lengthy discussion on security that's packed with information. Rauch points out that coding agents are simultaneously excellent code readers, which means they're also good at finding and exploiting vulnerabilities — "to understand the rules of code is to understand how to break them."

Vercel offered a $1 million bounty for sandbox escape solutions, and in the end only one security researcher made substantive progress, aided by a cluster of agents. The finding was subsequently shared with the industry, because the vulnerability involved Linux, and most of the world's infrastructure runs on Linux. Rauch uses this to emphasize that most enterprises have not yet truly solved agent security.

He also mentioned the real threat of prompt injection: agents will search for information with extreme "resourcefulness" to complete tasks, and may encounter hidden malicious instructions in YouTube comments or third-party sites — instructions that execute with the user's token and permissions. Sandboxes (he jokes the term is inaccurate; the Unix community's "jail" is more apt) and permission boundaries thus become prerequisites for enterprise agent deployment.

Another engineering direction discussed is constraining agent output with verifiable code. Rauch personally wrote a proof system over the weekend, exploring ways to have agents generate mathematically verifiable correct code — one of his sources of optimism about long-term security.

Prompt Injection is an attack targeting large language model applications: attackers hide malicious instructions in content that agents will read (such as web comments, documents, emails), inducing the agent to deviate from its original task and perform operations the attacker intends. It's divided into direct injection (the user directly inputs malicious instructions) and indirect injection (malicious content comes from third-party data sources); the latter is more dangerous for agents because agents typically run with the user's credentials and permissions. Since current LLMs struggle to reliably distinguish "data" from "instructions," there is no definitive solution to prompt injection; the industry mainly relies on defense-in-depth measures such as sandbox isolation, least privilege, and human confirmation of high-risk operations. OWASP has listed it as the top security risk for LLM applications.

Open-Source Models Consume 80% of Tokens

Rauch revealed traffic changes on Vercel AI Gateway: at the start of the year, the vast majority of tokens flowed to closed-source models like OpenAI, Anthropic, and Google; today 80% of tokens flow to open-source models. This data point spread widely on X.

The reason isn't complicated: open-source models are already good enough for coding tasks, and enterprises have found that 80% of the work — answering tickets, data classification, spell-checking, executing predefined plans — doesn't require "Einstein-level intelligence." Using frontier models for planning and open-source models for execution has become a common cost-effectiveness strategy. He specifically mentioned his experience with models like Kimi, noting that the boundary of "good enough" is moving fast.

This landscape poses a real risk to frontier model companies. Rauch offered a sharp analogy: it's similar to the crypto market — there are true believers and there are tourists, "a lot of people love a coin just because it's the hot coin for the next two months." He advises model companies to focus on metrics that can't be gamed — retention — rather than token volume manufactured through free credits or promotions. He even poses a rhetorical question: if the frontier intelligence advantage were truly durable, why are all these labs rushing into vertical applications?

Vercel AI Gateway is a model routing and unified access layer launched by Vercel; developers can call OpenAI, Anthropic, Google, and many open-source model providers through a single API. Its core value is abstracting away differences in SDKs and authentication, and providing unified observability (usage, latency, cost), automatic failover, rate limiting, and caching. For enterprises, Gateway makes the routing strategy of "frontier models for planning, open-source models for execution" flexibly switchable without changing business code — and it's also the data source that lets Rauch precisely track changes in token flows.

Implications for Developers and Enterprises

The interview returns to practical matters at the end. Rauch's advice to enterprises is not to stop: not implementing AI, not building agents, and not trying open-source models out of fear is the worst decision. He describes Silicon Valley today not as "two hours a week" but as "seven days a week, 7 a.m. to 7 p.m." — but emphasizes it's excitement, not suffering, because the rules are being written.

On hiring, Vercel values the ability to "command large numbers of agents and extract leverage from them," while placing enormous importance on the quality of human communication. Rauch's exact words: "I don't want to read your AI-generated tweet slop, I want to hear what you're actually thinking." The bar for technical competence is actually rising — because with curiosity and prompting ability, every problem becomes solvable.

As for whether serverless is dead, his answer is no, and he introduces the concept of "fluid compute": compute like a liquid, expanding when there's traffic and contracting when there isn't, simultaneously serving sandboxes, functions, websites, and agents. In his view, this is the next chapter of serverless.

Fluid compute is a computing paradigm proposed by Vercel to describe the next stage of serverless. Traditional serverless functions cold-start per request with short lifecycles, while fluid compute lets compute instances be reused across requests like a liquid and elastically scale with traffic — retaining the advantages of pay-as-you-go and zero ops while significantly reducing cold-start overhead and improving concurrency utilization. The same runtime can host diverse workloads including functions, websites, sandboxes, and agents, dynamically expanding or contracting based on actual usage. It attempts to respond to the "serverless is dead" skepticism: the paradigm hasn't failed — it's evolving from "functions as a service" to a more continuous, more efficient resource scheduling model.

One-line Summary

Vercel CEO interview: coding agent deployments surge from 3% to 60%, open-source models consume 80% of tokens.

Paragraph Summary

In an interview, Vercel CEO Guillermo Rauch revealed that deployments initiated by coding agents on the platform have surged from 3% at the start of the year to 60%, and that the company closed a $300 million Series F at a $9.3 billion valuation. He believes coding agents drive code generation costs toward zero, and that traditional SaaS will become "headless" — systems of record remain core, but interaction interfaces will be generated on demand by agents, with new protocol layers like MCP rising alongside. On security, he notes that agents are both excellent code readers and vulnerability discoverers, and that prompt injection and sandbox escapes are real threats; Vercel offered a $1 million bounty for escape solutions. On traffic data, 80% of tokens on AI Gateway now flow to open-source models, and frontier model companies face a retention test. His advice to developers: "reject non understanding" — read AI-generated code like an engineering manager.