WWDC Deep Dive, Part 2: Safari Goes Vibe-Coding — On-the-Fly Extensions, Notify Me, and Apple's Quiet Web-Scraping Turn
If Part 1 of this series was about the models, this one is about the surface that surprised me most:
Safari. I don't even use Safari day to day, and it's still the feature set I keep thinking about —
because Apple quietly turned the browser into a vibe-coding surface. Several of these features are
the browser writing small programs for you, on demand, from a sentence.
Let me walk through them, because the implications go well past Safari.
"Notify me" — a natural-language web watcher
This is the one I actually want to use. You go to a web page — one you check over and over waiting for
one little thing to change — and you tell Safari, in plain language, "notify me when X happens."
When the price drops to a number. When someone posts. When the page changes.
Under the hood, you've just vibe-coded a little background web scraper: a watcher that keeps polling
a page and pings you when your condition is met, with no code and no setup. I haven't seen anyone else
ship exactly this, and the use cases are real:
- A concert venue page — notify me when a specific artist gets a date.
- A restock or a price threshold on a product page.
- A new post from a creator, surfaced as a desktop notification.
It's a small feature, and the obvious question is "who's really going to use this?" — but it's the
first AI demo in a while that felt like something I'd reach for instead of the tired "I ordered a
pizza / booked a flight" set-pieces. I'm going to try hard to use it, precisely because there are
those weird recurring moments where you just want to know when a page changed.
Vibe-coded extensions — generated on the fly
This is the one I think is actually cooler than Notify Me. You can now ask Safari to build an
extension on the fly from a description. "I want this button here." "I want this thing to float."
Safari vibe-codes an extension that does it.
The example that sold me: imagine you're on a streaming/recording tool, and you'd love an extension
that mirrors and floats the window so you can put a guest on your teleprompter. Instead of finding,
installing, and configuring a third-party extension — or writing one — you just describe the
behavior and Safari generates it.
That's a meaningful shift in what a "browser extension" even is. It stops being a packaged artifact you
install and becomes an intent you express. And the moment you internalize that, you start asking
the bigger question (more on that below).
Tab grouping — local AI for your bad habits
There's an AI tab-grouping feature too: the browser clusters your tabs for you, locally (it runs
on-device, which is the right call for something this personal). I'll be honest about my bias — I keep
a clean tab environment and I don't believe in merging things, so this isn't for me.
And a gentle reality check for the tab-hoarders it is for: your problem isn't that your forty tabs
are ungrouped. Your problem is forty tabs. Grouping them is more likely to make you comfortable opening
more tabs than to make you close any. Still — local, private, opt-in. Fine.
The "yikes" feature: background password changes
Here's where the vibe-coding turn gets a little unsettling. Safari (via the Passwords app) can, on
supported sites, change your password for you in the background — open a little headless Safari,
navigate the site's flow, and rotate the credential.
The intent is good: a password is compromised or weak, and instead of just warning you, the browser
fixes it. Pushed further, you can imagine Apple rotating every password every 30 days automatically
— which would be genuinely great for security hygiene.
But sit with the mechanics for a second. This is an AI driving web flows and scraping pages on your
behalf to mutate your credentials. What could go wrong is exactly what you'd think: it changes a
password to something you never see, the save fails (as password managers do a non-trivial fraction of
the time), and now you're locked out. I want this feature. I'm not sure I trust it yet. That tension is
the honest review.
The pattern under all of it: Apple is vibe-coding web scrapers
Step back and the theme is unmistakable. Notify Me is a vibe-coded scraper. Background password change
is a vibe-coded scraper-plus-actuator. Even some of the Passwords-app behavior is "open a headless
browser and read the page." For years the conventional wisdom was scraping is sketchy, don't script
other people's sites. Apple just made natural-language web automation a first-class, built-in OS
feature. The Overton window on "the browser will programmatically operate sites for you" moved, and
it moved with Apple's name on it.
The real question for app developers
Here's why I think every app developer should care, even if you never touch Safari: the headline isn't
"Safari got features." It's "natural-language, on-the-fly extensibility is now an expectation."
So turn it on your own app. If users can tell Safari "add this behavior" and get it, they're going to
start wishing they could tell your app the same thing. To make that possible, you need the same
ingredients Apple just leaned on:
- An extension/scripting surface — a sanctioned place where generated code or declared behavior can
hook in (add UI, react to events, transform data). - A scripting language or declarative contract the model can target, with guardrails so a
vibe-coded extension can't wreck the app or exfiltrate data. - A permission and review model — because the moment an AI writes code that runs in your app, "what
could go wrong" is a security question, not a rhetorical one.
This is the same conversation playing out everywhere right now (it's why Shortcuts went
natural-language too — you can now "vibe with words" to build an automation instead of staring at 8,000
actions). The browsers and the web crowd have been living in this generate-and-run world for a while;
native app developers are about to be pulled into it. The teams that win will be the ones who, this
year, quietly add a clean extension mechanism to their app — so that when the "just describe what you
want" expectation arrives, they can say yes.
Where I land
Safari's AI features are the sleeper story of this WWDC. Notify Me is the one I'll actually use,
vibe-coded extensions are the one that rewires how I think about extensibility, and background password
changes are the one I want but don't yet trust. Taken together they're a clear signal: the browser is
becoming a place where you describe behavior and the machine writes it — and that expectation is
coming for the rest of our apps next.
Previous: Apple's native AI for developers.
Next: Xcode 27's real story
— the Agent Client Protocol, MCP, and the end of the simulator.