The code compiled The tests passed The PR was green So I merged it.
Days later I was looking at something completely unrelated when I noticed it: a state update that had been technically correct in exactly the way I'd asked for, had quietly broken an assumption the rest of the system depended on. The update itself was fine. The problem was that another piece of state was supposed to change along with it and that relationship wasn't obvious from the function I was editing. The tests covered the updated state. They didn't cover the relationship between the two Nothing had crashed. No test had failed. No reviewer, including me, had caught it at the time.
The scary part wasn't that AI wrote the code. I'd expected AI-written code to have bugs, the obvious kind, the kind a test catches immediately.
The scary part was that everything, every single signal I normally trust, told me the code was correct.
That's the actual problem with AI-generated code. Bad code is easy to distrust. Code that passes every test you throw at it is much harder to question, and that's exactly backwards from how risk should work.
