One engineer used AI to rewrite a core tool — saved $500K a year

A single engineer at cybersecurity company Reco used AI to completely rewrite a critical piece of their data pipeline — in seven hours, for $400 in AI tokens. The result? A tool that runs 1,000 times faster and saves the company $500,000 every year.

This isn't a hypothetical. The rewritten tool is already processing billions of events in production.

The $300K problem nobody could solve

Reco's security platform needs to check billions of data events against thousands of detection rules every day. To do this, they use a query language called JSONata — think of it as a way to ask questions about structured data, like "show me all login attempts from this email address."

The problem: JSONata's original code was written in JavaScript, but Reco's main system runs in Go (a different programming language). So every time they wanted to check an event against a rule, the data had to be packaged up, sent across the network to a JavaScript process, processed, packaged up again, and sent back.

This constant back-and-forth was costing $25,000 per month in computing power alone. One of their larger clusters had scaled out to over 200 separate processes just for this. The monthly bill kept climbing as they added more customers.

The Cloudflare playbook — applied to their own problem

The inspiration came from a Cloudflare blog post where one engineer used AI to rebuild a major web framework. The approach was simple: take the official test suite (the list of everything the tool is supposed to do correctly), point an AI at it, and have it write code until every test passes.

Nir Barak, Reco's Principal Data Engineer, spent a weekend planning the approach with AI, then pressed "play" the following day.

It didn't just match the original — it found bugs in it

The new tool, called gnata, didn't just replicate the original JavaScript version. It actually found bugs in the original code — cases where the reference implementation didn't follow its own specification. The AI-generated version handles those cases correctly.

The rollout was cautious. After the initial build, the team spent nearly a week running gnata in "shadow mode" — processing real production data in parallel with the old system and comparing results. After three consecutive days of zero mismatches across billions of events, they promoted it to primary.

Where the $500K actually comes from

The first $300K came from eliminating the fleet of JavaScript processes entirely — gnata runs as a library inside existing Go services, so there's no network overhead at all. Simple lookups that used to take 150 microseconds (because of the network round-trip) now take 42-95 nanoseconds — roughly 1,500 times faster.

The remaining $200K came from a follow-on optimization: because gnata can evaluate multiple expressions at once (the old system could only do one at a time), the team was able to simplify their entire rule engine. This eliminated tens of thousands of concurrent processes and dramatically reduced memory and CPU usage.

Try it yourself

The team open-sourced gnata under the MIT license. If you work with JSON data processing:

go get github.com/recolabs/gnata

Full documentation and a WASM playground are available at github.com/RecoLabs/gnata.

The bigger picture

This follows a pattern that's accelerating across the industry. Cloudflare rebuilt Next.js with AI. Now Reco rebuilt JSONata. As engineer Nir Barak put it: "I suspect 2026 will be the year of surgical refactors."

The takeaway for any company paying a significant cloud bill: if you have a performance bottleneck caused by a language mismatch or legacy architecture, AI-assisted rewrites are no longer theoretical. They're happening in days, for hundreds of dollars, and saving hundreds of thousands.

Related Content — Get Started with Easy Claude Code | Free Learning Guides | More AI News