Cursor SDK, Figma Make's Voice, Postgres on Vercel, and the ACM's Verdict — The Week Vibe Coding Became Real Infrastructure

For most of the last year, every weekly recap of vibe coding has been a list of launches inside the same kind of object: a tool with a chat box, a preview pane, and a deploy button. Lovable. v0. Replit. Bolt. Cursor. Figma Make. Each one a slightly different shape of the same product.

Last week, between April 27 and May 3, 2026, the shape changed.

Four launches landed that aren't really features at all. They're plumbing. They expose the parts of vibe coding that used to be locked inside one app — the agent, the iteration loop, the database, the policy debate — and turn each one into something the rest of the stack can talk to.

April 28 — Cursor released the Cursor SDK in public beta, a TypeScript API that lets any program create, run, and manage Cursor agents from scripts, CI/CD pipelines, and customer products. Rippling, Notion, Faire, and C3 AI are named early adopters.
April 30 — Figma Make shipped a release adding voice-to-text prompts, full version history, question cards for structured mid-build choices, a one-click clear-context reset, and a Zapier connector pulling in 9,000+ apps.
Early May — Vercel Sandbox opened up direct connections to hosted Postgres at Neon, Supabase, AWS RDS, Nile, and Prisma Postgres, with a Postgres-aware firewall and in-dashboard SQL.
April 30 — The ACM's Technology Policy Council published its first TechBrief on vibe coding, formally placing the category in the academic and policy conversation.

Each story dissolves a different boundary that used to keep vibe coding penned inside a single tool: programmability, the iteration loop, real data, and institutional legitimacy. Add them up and you get the most consequential quiet shift of the year so far for non-technical builders — vibe coding stopped being software you use and started being infrastructure you ship on.

Here's what each story actually changed, why they belong together, and how to take advantage of the new shape.

1. The Cursor SDK Turns Agents Into a Pipeline Component

Until last Tuesday, running a Cursor agent required opening the Cursor desktop app, the CLI, or the web interface. The agent was a destination — you went to it. As of April 28, 2026, the agent is now a service. You call it.

The Cursor SDK is a TypeScript API, available in public beta, that exposes the same runtime, harness, and frontier models that power Cursor's interactive product. Run npm install @cursor/sdk, write a few lines, and you're spinning up agents from your own code, scripts, CI workflows, or customer-facing products.

What ships in the box:

Three deployment modes. Run agents on a developer's local machine for fast iteration, on Cursor's cloud against a dedicated sandboxed VM for strong isolation, or on self-hosted workers for teams with strict network requirements.
Codebase indexing, so the agent has the same repo-aware context it has inside the desktop product.
MCP server support, skills, hooks, and subagents. Everything the desktop agent can do, the SDK can do.
Token-based consumption pricing, billed at standard Cursor SDK rates.
Confirmed early adopters at launch — Rippling, Notion, Faire, and C3 AI, with publicly described use cases including ticket-to-PR automation, autonomous bug fixing, CI/CD summarization, and embedding agent experiences inside customer-facing products.

If that list reads like an enterprise pitch, look closer. The thing being shipped isn't an enterprise feature. It's a category move.

For two years, the assumption underneath every AI app builder has been that the agent and the chat UI are inseparable. You picked the tool because you liked the chat. The Cursor SDK quietly invalidates that assumption. The agent can now live anywhere — including under the hood of a tool whose chat box you do like, with no compromise on the underlying model, indexing, or guardrails.

For non-technical builders specifically, three things shift:

Your favorite app builder can keep getting smarter. Tools above the agent layer — Lovable, v0, Replit, internal corp builders — can now stand on a fully managed agent without building one. That's why early-adopter list reads like a "tools that ship to non-technical users" list, not a "developer tools" list. Notion, Rippling, and Faire are not selling agents to engineers; they're shipping agent-powered experiences to ordinary users.
Routine engineering chores get automated by default. "Ticket-to-PR" automation means: ticket comes in, agent reads it, agent writes the PR, reviewer agent checks it. The non-technical builder doesn't see this happen; they just notice that the engineering team feels more responsive.
The agent moats stop mattering. Every tool that wanted to compete on agent quality now has the same option Cursor's competitors have: build, or call the SDK. That collapses one of the lock-in stories in the category and pushes the value upward into UX, integrations, and skills — exactly the layers non-technical builders care about.

The SDK is small in headlines and large in implications. Cursor went from being a tool to being a tool and a platform in the same week. Watch for the second derivative — the apps you love most should start feeling sharper without you knowing why.

2. Figma Make Adds the Loop Pieces Real Engineering Has

While Cursor was opening up the agent, Figma was tightening the loop around its own design-to-app product. The April 30, 2026 Figma Make release shipped five things in one drop, each addressing a separate complaint that anyone using Make for serious work has voiced in the last six months.

Voice-to-text prompts. You can now dictate a prompt directly into Make chat. Cleaned text appears for review before you submit. This isn't a gimmick — it's the same primitive Lovable shipped on mobile the week before, and the reason it matters is identical. The moments when you have ideas about your product are not the moments when you have a keyboard handy. Voice closes that gap.

Full version history with one-click revert. Make now tracks every version of your build and lets you jump to any prior state. The classic Make failure mode — "the agent broke something three iterations ago and I can't get back" — is over. This is the most boring of the five updates and probably the most valuable. Real software has had this since the 1980s. Vibe coded software finally has it too.

Question cards. When the agent is unsure between two paths, it now presents structured options as cards in chat, each with a short description of the tradeoff. You pick. The agent acts. The big shift here isn't about UI; it's about authorship. Question cards turn the build from "agent guesses, you correct" into "agent asks, you decide." That's a different power balance, and it's the one non-technical builders actually want.

Clear context. A one-click reset button in Make settings clears the agent's accumulated context without touching your file or your work. If you've ever wanted to say "forget everything we just talked about, start fresh from where the file is now" and couldn't, this is the button.

A Zapier connector. Make can now pull context from Google Drive, Microsoft 365, Zoom, and 9,000+ other apps. The implication is bigger than a single integration — Make's source of truth is no longer just your design file. It can be your team's actual operating data.

Take the five together and Make stops being "Figma's AI feature" and starts being something closer to a real engineering loop: voice in, options on every fork, history on every state, fresh context on demand, and live data from anywhere your team works. That's a thoroughly different product than the one Make was at the start of April.

The reason this is a vibe coding story rather than a design tool story: the people using Figma Make aren't all designers. The PM building an internal dashboard, the CS lead shipping a customer portal, the founder mocking out a feature for the engineering team — these were always Make's actual users, even when the marketing was about handoff. April 30 was the day Make stopped pretending its job was handoff and started fully owning the role of an AI app builder for non-technical people who happen to think visually.

3. Vercel Sandbox Now Talks to Real Databases

The third quiet move of the week is the one most non-technical builders will feel before they see. In May 2026, Vercel Sandbox — the runtime that backs v0 and a growing percentage of AI-built Next.js apps deployed on Vercel — gained direct, firewalled connections to hosted Postgres on Neon, Supabase, AWS RDS, Nile, and Prisma Postgres.

A few specifics from the changelog:

The Sandbox firewall now understands the Postgres TLS negotiation flow. It detects the protocol's startup sequence, waits for the TLS upgrade, then applies your domain policy before forwarding the connection. Translation: secure DB connections work without a builder doing security configuration.
You can now run SQL queries, view and edit rows, and inspect schemas for AWS Aurora Postgres, Neon, Prisma, and Supabase directly from the Vercel dashboard. No third-party DB client required.
Vercel Sandbox also gained custom tags — up to five per sandbox — for organizing, filtering, and managing sandboxes at scale.

The clean translation, for someone who doesn't run their own infra: the AI-built app you ship on Vercel can now have a real production-grade database, configured by prompt and managed in the same dashboard as the app. The data layer that used to be the most common downgrade in a vibe-coded build — "I built it on Sheets" or "I built it on Airtable" — can now be Postgres at Neon, Postgres at Supabase, or RDS, with the same security posture engineers expect.

Three reasons this matters more than it sounds:

Sheet-shaped apps stop being the only option. A spreadsheet-backed prototype is fine for the first 50 users. The 50th-to-5,000th-user gap is where most non-technical builds historically died because the team couldn't migrate to a real DB without an engineer. This kills that gap.
You stop choosing between AI builder and "real database." Six months ago, "I want a hosted Postgres" was the moment a non-technical builder traditionally hit the limit of what their tool could do. Now it's a checkbox.
Your CRM, your analytics, and your finance integrations all get easier. Real Postgres + AI-generated app code = AI agents that can write to your operational store and read from it. The integrations layer above it (Plaid, Stripe, Snowflake, your data warehouse) is meaningfully cheaper to build against.

This is the third week in a row that one of the major AI app builders has expanded the data plane that vibe-coded apps can talk to — Replit's Plaid connector unlocked banking data, Vercel's marketplace database flow unlocked hosted Postgres, NetSuite's SuiteCloud Agent Skills unlocked ERP. The pattern is the same in every case: the platform absorbs the integration work that used to cost an engineer a week.

4. The ACM Has Officially Weighed In — And That's a Good Thing

The fourth story of the week is not a launch. It is a 2026-flavored kind of milestone: the Association for Computing Machinery's Technology Policy Council published its first TechBrief on vibe coding on April 30, 2026.

The TechBrief — titled "AI-Assisted Software Development, or Vibe Coding: Benefits and Risks of AI-Driven Software Development" — does the thing institutional reports do. It defines the term carefully. It surveys benefits. It raises risks. It recommends safeguards. The risks it raises are the ones you'd expect: security vulnerabilities inherited from training data, inconsistent or missing testing, code that becomes hard for humans to review or maintain, and the unique class of problems posed by agentic tools that can execute code across systems — including unintended file deletions, data exposure, and prompt injection.

The conclusion is the part that matters: vibe coding is likely to play a central role in the future of software development. What's needed is improving code quality and accountability to make it safe at scale.

If you've spent any time in the vibe coding community, you can read between those lines. Two years ago, the dominant framing in academic computing was that AI-assisted coding was a curiosity, possibly a fad, and best left to research papers. The most prestigious computing organization in the world publishing a policy brief titled "Benefits and Risks of AI-Driven Software Development" is not a curiosity report. It's an admission that the category is here, the category is significant, and the conversation has moved from "is this real?" to "how do we make this safe?"

That is unambiguously good news for non-technical builders, for three reasons:

Legitimacy is now off the table as an objection. When the ACM treats your category as a permanent fixture of the software industry, the "vibe coding isn't real software" argument loses its institutional standing. You stop having to defend the existence of the category every time you describe what you do.
The risks the brief flags are addressable. Every concern in the document — testing gaps, security inheritance, maintainability, agentic execution risk — is the same set of concerns the platforms have been actively closing in the last six months. Agent-fleet review (Anthropic's /ultrareview), security agents (Replit), sandboxed VMs (Cursor cloud, Vercel), policy hooks (Cursor SDK hooks), and now formal academic attention create a feedback loop that's been missing.
Policy and platform are now aligned in a way that protects builders. When ACM-style documents shape regulation and procurement language, the floor for "what counts as a responsible AI coding tool" rises. That floor benefits the builders standing on top of those tools — you — far more than it benefits anyone trying to ship without it.

The brief is not a coronation. It's a policy artifact. But policy artifacts mark turning points, and this one is the clearest external signal yet that the trend is mainstream.

What All Four Stories Have in Common

Sketch them on a whiteboard and the four stories aren't a list. They're four sides of the same shape:

| Layer | What got plumbed last week | |---|---| | Agent | Cursor SDK — the agent is now a callable service, not a destination. | | Loop | Figma Make — voice in, options on every fork, history on every state, fresh context on demand. | | Data | Vercel Sandbox + Postgres — vibe-coded apps connect directly to Neon, Supabase, AWS RDS, Nile, and Prisma. | | Discourse | ACM TechBrief — the category is now in the policy and academic record. |

What unifies them is the phrase "real infrastructure." Real infrastructure isn't one big thing. It's a quiet collection of small things that work together so the user above them can stop thinking about what's underneath. Power grids. The HTTPS handshake. SQL. Cloud storage. Each of these once felt brittle and bespoke. None of them feel that way now, because the layer below the user got steady.

That's what last week was. Vibe coding's layer below the user got measurably steadier in four directions in the same seven days.

How Non-Technical Builders Should Adapt

The four launches are a strong signal that the right way to think about your toolkit is changing. Four small habit shifts will keep you on the right side of the new shape:

Stop choosing your tool by its chat box. Start choosing it by what it can call. Tools whose underlying agent layer is now standardized (via Cursor SDK or similar emerging APIs) will feel sharper week over week. Tools that double down on agent lock-in will feel slower. Pay attention to which side your favorite is on.
Add voice as a first-class input wherever you build. Lovable mobile got it. Figma Make just got it. Wherever your tool offers it, turn it on. Voice prompts capture ideas at the speed they arrive in your head, which compounds across a week of building in ways typing never can.
Move your data layer up to a real Postgres provider, even on small projects. Neon and Supabase free tiers cost nothing and unlock every other integration you'll want later. The friction that used to keep non-technical builders on Sheets is gone; the only thing left is habit.
Read the ACM TechBrief, then read your own platform's response to it. Knowing what the formal computing community considers risky lets you ask sharper questions about your tools — and rewards the platforms that are moving fastest on those exact risks. The platforms that ignore the document are the ones to be skeptical of.

The Bigger Picture

For two years, vibe coding's product story has been: pick a single tool, type into it, deploy what comes out. The pitch was simplicity, and the simplicity was real.

Last week's four stories quietly described the next chapter. The agent is now a service the rest of the stack can call. The build loop has voice, branching choices, and revision history. The database is real. The category has institutional legitimacy. Each piece is small. Together they describe a fabric — small interoperable parts that show up where you need them and stay out of your way the rest of the time.

The most underrated phrase in the ACM brief is the one that says vibe coding is "likely to play a central role in the future of software development." That's not a prediction. It's a description of what last week looked like.

The desk you're building from is no longer one app. It's a stack: a programmable agent, a voice-driven loop, a real database, and a public conversation about how to make all of it accountable. That stack belongs to you. It works while you focus on the part nobody else can do — having the right idea, in the right place, at the right time.

Keep building.

The Vibe Coding Desk is Voxel's weekly readout on AI app builders, agentic coding, and what every shift means for non-technical builders. New posts ship most weeks.

Sources: