Which bugs are we burying right now

"You'll do that in five minutes with AI." The sentence has been circulating in meetings for a couple of years, usually from people who won't have to maintain that code in eighteen months. I run frontier models on real repositories, not demos, and what I see every day doesn't look like that sentence.

The pattern repeats, and it barely changes between models. You give a precise instruction with explicit constraints. What comes back resembles the request, plus deviations nobody authorised: a file touched that was out of scope, a dependency added on its own initiative, a step reported as done that was never verified. That last one has a name in the literature on agent operational failures: misleading completion claims.

The numbers, not the impressions

This isn't anecdote, and it isn't measured by me.

• Veracode tested more than a hundred models on security-sensitive tasks: 45% of generated code introduces an OWASP Top 10 weakness
• GitClear, across 211 million changed lines, measures duplicated blocks up 81% since 2023, copy-paste rising from 9.4% to 15.7%, and refactored rather than rewritten code collapsing from 13% to 3.8%
• An analysis of 20,574 real IDE and CLI agent sessions finds developers correcting or pushing back on the output in 41% of turns
• Across 6,000 sessions and 355,000 tool calls, only 44% of agent-written code survives into the final commit

Meanwhile the same models sit between 80% and 97% on SWE-bench. Worth remembering: of a hundred models on the leaderboard, exactly one carries an independent verification badge. The other ninety-nine submitted a score measured in-house, on their own harness.

In the code itself the flaw is less visible and more durable. Early exit essentially absent, five levels of nesting, names describing implementation instead of intent. Nothing that fails to compile. Everything that makes a system unmodifiable in two years.

The suspicion, and the boring version

Hence a suspicion, and I label it as such — a suspicion, not an accusation: that unfinished work is not always an accident, and that someone benefits from the next round trip.

I don't fully believe it, and the boring version worries me more. No bad faith is required for the same outcome. A system trained to produce answers that look complete learns to make them look complete. Nobody ordered anything. You can correct an intention; you cannot correct an incentive.

Debt with no due date

But the real point comes after. That code is going into production now: ERP, banking, logistics, healthcare. Written fast, read quickly, approved by someone who assumes that if it compiles and the tests pass then it's done, and often reviewed by the same class of model that wrote it.

So the question isn't whether AI writes good code today. It's which bugs we are burying right now, in systems somebody will reopen in five years with nobody left who knows what's inside. Not the crash you see immediately: that's the lucky case. The off-by-one in an accrual. The branch never covered. The silent catch that swallows the exception.

We knew about the year 2038 problem two decades ahead. This debt has no date, no inventory, and nobody is tracking it.

This is not a position against AI: I use it every day and it makes me faster. It's a position against "five minutes". Are you reviewing generated code with the same rigour as handwritten code, or faster, because it already looks finished?