Ask Claude Code, Cursor, or Copilot to add a dependency and it names one — instantly, confidently. That confidence comes from training recall: a snapshot of scraped code frozen at a cutoff date. So the agent can't know your team already has an internal, audited library for this. It can't know the package it just named went unmaintained six months ago, or that a supply-chain advisory landed last week. It picks anyway, with identical confidence either way.
Here's the part that compounds: a wrong pick doesn't bounce off. It gets written into your codebase — a hand-rolled auth flow, a dependency on an abandoned package, a second module that duplicates something you already own. That's tech debt the agent created and you inherit. And it's debt with interest: the agent builds on the bad choice, the problem surfaces downstream, and then you pay again — in tokens, review time, and rework — to unwind and redo it.
That's not a prompt problem. You can't fix it by asking the model to "be careful." The model is doing recall where it should be doing evaluation, and recall is frozen.
What recall costs you
A few findings that should make you nervous about an agent picking dependencies unsupervised — and notice not one of these is only a security problem:
