8 ms·

I don't know, my colleague refuses to use AI and I've been seeing more bugs from their side, while reducing bugs on my side with the help of AI. That said if c

I don't know, my colleague refuses to use AI and I've been seeing more bugs from their side, while reducing bugs on my side with the help of AI. That said if companies want to "ship ship ship fast", then yes even AI can produce bugs or regressions if not carefully reviewed by the human.

bossyTeacher 1mo ago
> I've been seeing more bugs from their side, while reducing bugs on my side with the help of AI. You should question your ability to see any bugs on YOUR side.
Ancapistani 1mo ago
I don't have any colleagues like that anymore, but even as far back as the last half of 2025 I was seeing that automated AI review was becoming effective enough that I considered it essential to any project where security was a serious concern. These days we're generating multiple times more code than we were writing before. That means a similar multiple of opportunities for bugs to be introduced - so the ability to automate security review is more impactful in proportion to that.
Forgeties79 1mo ago
Have you asked your colleagues what it’s like to deal with your code?
- boc 1mo ago
  It's not 2025 anymore my friend.
  - Forgeties79 1mo ago
    Yet apparently people still dump unvetted LLM outputs onto their colleagues and expect them to thank them for the privilege. So it’s worth asking them what the consensus is of their work to find out if it’s the case.
    - leptons 1mo ago
      That's the old way. The current way is nobody reviews anything. The LLM reviews it all and nobody even reads it, they just click approve, and merge blindly. I wish I were kidding.
      - mlrtime 1mo ago
        Not where I work. We have both review PRs.
      - DANmode 1mo ago
        > nobody Speak for your workplace only. Most places still consider a PR or commit yours, if your name is attached. Act accordingly.
        leptons 1mo ago
        >Act accordingly I've been looking for a new job where people aren't so reckless... the AI psychosis is heavy at my current job.
kelnos 1mo ago
> while reducing bugs on my side with the help of AI. How do you know? You might be adding (latent) bugs every time your LLM fixes one for you.
- remus 1mo ago
  Same as usual: add tests. Over time the test suite becomes the spec that describes how the software should function. As the test suite grows you squeeze out room for undefined behaviour and bugs.
  - coldtea 1mo ago
    >Same as usual: add tests. Over time the test suite becomes the spec that describes how the software should function. That covers functionality - it doesn't catch the kind of bugs talked about in TFA.
- tonyedgecombe 1mo ago
  I remember decades ago IBM published some research that said that every two bug fixes resulted in a new bug.
  - budman1 1mo ago
    As long as the first derivative is negative, you can finish with a usable product. If the first derivative is positive, adding people does not help.
    - tonyedgecombe 1mo ago
      Yes, it just means your bug queue is twice as long as you think it is. https://en.wikipedia.org/wiki/1/2_%2B_1/4_%2B_1/8_%2B_1/16_%2B_⋯ https://en.wikipedia.org/wiki/1/2_%2B_1/4_%2B_1/8_%2B_1/16_%...
juleiie 1mo ago
The point is that people who want to be secure can be more secure than ever while people who don’t care about security will be less secure than now. Author claims something slightly different but that’s how I would look at it. The extremes are more potent because either you get super secure 10 times vetted system or you get underpowered model slop with all the vulnerabilities it entails.

bossyTeacher 1mo ago

> I've been seeing more bugs from their side, while reducing bugs on my side with the help of AI. You should question your ability to see any bugs on YOUR side.

Ancapistani 1mo ago

I don't have any colleagues like that anymore, but even as far back as the last half of 2025 I was seeing that automated AI review was becoming effective enough that I considered it essential to any project where security was a serious concern. These days we're generating multiple times more code than we were writing before. That means a similar multiple of opportunities for bugs to be introduced - so the ability to automate security review is more impactful in proportion to that.

Forgeties79 1mo ago

Have you asked your colleagues what it’s like to deal with your code?

boc 1mo ago
It's not 2025 anymore my friend.
- Forgeties79 1mo ago
  Yet apparently people still dump unvetted LLM outputs onto their colleagues and expect them to thank them for the privilege. So it’s worth asking them what the consensus is of their work to find out if it’s the case.
  - leptons 1mo ago
    That's the old way. The current way is nobody reviews anything. The LLM reviews it all and nobody even reads it, they just click approve, and merge blindly. I wish I were kidding.
    - mlrtime 1mo ago
      Not where I work. We have both review PRs.
    - DANmode 1mo ago
      > nobody Speak for your workplace only. Most places still consider a PR or commit yours, if your name is attached. Act accordingly.
      - leptons 1mo ago
        >Act accordingly I've been looking for a new job where people aren't so reckless... the AI psychosis is heavy at my current job.

kelnos 1mo ago

> while reducing bugs on my side with the help of AI. How do you know? You might be adding (latent) bugs every time your LLM fixes one for you.

remus 1mo ago
Same as usual: add tests. Over time the test suite becomes the spec that describes how the software should function. As the test suite grows you squeeze out room for undefined behaviour and bugs.
- coldtea 1mo ago
  >Same as usual: add tests. Over time the test suite becomes the spec that describes how the software should function. That covers functionality - it doesn't catch the kind of bugs talked about in TFA.
tonyedgecombe 1mo ago
I remember decades ago IBM published some research that said that every two bug fixes resulted in a new bug.
- budman1 1mo ago
  As long as the first derivative is negative, you can finish with a usable product. If the first derivative is positive, adding people does not help.
  - tonyedgecombe 1mo ago
    Yes, it just means your bug queue is twice as long as you think it is. https://en.wikipedia.org/wiki/1/2_%2B_1/4_%2B_1/8_%2B_1/16_%2B_⋯ https://en.wikipedia.org/wiki/1/2_%2B_1/4_%2B_1/8_%2B_1/16_%...

juleiie 1mo ago

The point is that people who want to be secure can be more secure than ever while people who don’t care about security will be less secure than now. Author claims something slightly different but that’s how I would look at it. The extremes are more potent because either you get super secure 10 times vetted system or you get underpowered model slop with all the vulnerabilities it entails.