We asked Claude Code to add input validation to a single route handler. The task required editing one file. Roughly 20 lines of code.
Here is what happened before it wrote a single character.
The setup
We built a standardised benchmark: a small Node.js/Express user management service with a POST /users endpoint that was deliberately missing input validation. The task was identical for both agents: add validation for name, email, and password, return 400 with a descriptive error for each failure case.
We ran each agent under strace -f, recording every openat, connect, execve, and getdents64 call made by the agent process and every subprocess it spawned1. All runs used a fresh copy of the project. We ran Claude Code twice to check stability; the results were within 0.5% across both runs.
