Summary
- Developer Simon Willison argues October 2026 marks a new inflection point where AI models — particularly Claude Opus 5.5 — can produce genuinely fun, complete games with minimal human creative input.
- Willison built four browser-based games, including a multiplayer real-time strategy title, spending fewer than four hours of his own time on each while the model handled code, 3D assets, music, dialogue, and game design.
- The same ‘vibe coding’ workflow — prompting without reviewing the underlying code — that is already common in software development now extends to the full game development stack.
- GPT-6 Astra was assessed as capable of building games but not yet matching Opus 5.5 on subjective qualities like ‘fun’; Willison expects OpenAI to close that gap before year-end.
- The pattern has direct parallels to enterprise software development: AI-generated code, assets, and logic are being shipped with little or no human review of the underlying implementation.
A capability threshold, not a trend line
Simon Willison, whose earlier writing tracked the November 2025 moment when AI coding agents became reliable daily tools for software engineers, is now describing a comparable shift for game development. His position is that Claude Opus 5.5 has crossed a threshold where it can produce software that is not merely functional but genuinely engaging — including game design, 3D modelling, music, dialogue, and plot — with the developer providing little more than a concept and occasional redirects.
What the experiments actually showed
Willison documented four browser-based games built over recent weeks. The simplest, Tree Appreciator, was produced in a single prompt using the standard Claude chat interface — no specialised coding agent required. The most complex, Battle Drones, is a Command & Conquer-style real-time strategy game that now supports two-to-four player multiplayer, medals, replays, seven maps, a random map generator, and a mode where different AI models compete against each other. Willison estimates he spent fewer than four hours of his own time on any individual project, with the model running autonomously for far longer periods. A fourth project, a pumpkin-farming simulator tied to his local community’s annual festival, was built after an extended brainstorming session and described as still in iteration — not yet as polished as Battle Drones but notable for its specificity and character.
The ‘no code review’ workflow is the signal worth watching
Willison is explicit that his approach involves no review of the generated code. He describes this as ‘vibe coding in the classic sense of the term.’ For security leaders, that phrase carries weight. The same workflow is already present in enterprise environments, where developers use AI assistants to produce code they may not fully inspect before committing. The game development context is low-stakes by comparison, but the underlying behaviour — AI generating substantial, functional, multi-component software with minimal human verification — is the same pattern appearing in higher-risk settings.
Open source and forking add another dimension
Battle Drones was released under the Apache 2.0 licence. Within a day, another developer forked it and released a reskinned version — new models, new music, an animated intro — under the name Panache. Willison notes this as open source working as intended. For security teams, it is also a reminder that AI-generated codebases, once published, propagate through the same supply chain mechanisms as any other open source project, carrying whatever vulnerabilities or unreviewed logic the original generation introduced.
Model comparison and current limits
Willison compared outputs from Opus 5.5 and GPT-6 Astra directly, feeding the same initial prompts to both for the Emberwick RPG project. His assessment is that GPT-6 Astra produces visually capable games but does not yet match Opus 5.5 on playability and subjective engagement. He expects OpenAI to reach a comparable point before the end of the year. No independent corroboration of this comparison is available in the source material.
Why it matters
CISOs should read this as a leading indicator rather than a curiosity. The capability demonstrated here — an AI model producing thousands of lines of functional, multi-component software with no human code review — is not confined to games. The same models and workflows are present in enterprise development pipelines. When a developer prompts an AI agent to ‘make it a LOT more fun’ or ‘make it really good’ and the model obliges by autonomously rewriting significant portions of a codebase, the security properties of that code are entirely dependent on the model’s training, not on human verification. The open source dimension compounds this: AI-generated projects that are forked and extended carry their provenance — including any unreviewed logic — into downstream dependencies. Security teams that have not yet formed a clear position on AI-generated code in their supply chain are behind the curve.
What to do now
- Assess whether your organisation’s secure development lifecycle policies explicitly address AI-generated code, including code produced by agents operating autonomously over extended periods without developer review.
- Evaluate whether your software composition analysis and SAST tooling is applied to AI-generated code with the same rigour as human-written code — the source of the code does not change the need for review.
- When open source components are ingested, check whether they are AI-generated and whether any downstream forks or dependencies share that origin, as provenance affects your ability to assess review history.
- Engage development teams on the distinction between using AI as a coding assistant with review checkpoints versus fully autonomous ‘vibe coding’ workflows where no human inspects the output before deployment.
