u/Ambitious-Garbage-73

Something about the AI coding narrative stopped making sense to me a few months ago. On one side you've got GitHub saying hand-typed code "days are quickly slipping behind us" and every vendor promising 10x productivity. On the other side my Slack DMs are full of coworkers sharing horror stories about AI-generated PRs that looked right but broke things nobody caught until production.

I couldn't tell which version was real. So I did the thing I do when I can't tell which version is real. I started a markdown file and spent a weekend going through every public incident, study, and postmortem I could find where AI coding tools caused measurable damage in 2026. I wanted actual incidents with numbers attached, not vibes or "Claude felt dumber this week" type complaints.

Here's what's in that file.

The Amazon Q incident nobody outside AWS circles is talking about.

Between March 2 and 5, Amazon Q guided an engineer to follow instructions from an outdated internal wiki. The result was cascading checkout and pricing failures across their retail platform. 120,000 lost orders on March 2. Then 6.3 million lost orders on March 5 with a 99% drop in US order volume. Six hours of customer-facing outage. Total estimated cost runs north of $100 million.

Amazon's internal postmortem attributed root cause to "an engineer following inaccurate advice that an agent inferred from an outdated internal wiki." Their public statement blamed "misconfigured access controls" and "human error." The word AI did not appear.

After the incident, Amazon imposed a 90-day code safety reset across 335 critical systems. AI-assisted code changes now require senior engineer approval before they can be deployed. The company that makes one of the most popular AI coding tools had to emergency-brake its own AI pipeline on 335 systems. Think about that for a second.

Anthropic's silent degradation of Claude Code.

This one was confirmed by Anthropic themselves so there's not much to argue about. On April 23 they published a postmortem admitting three separate engineering missteps had been degrading Claude Code since March 4. The default reasoning effort was dropped from high to medium to cut costs without telling users. A caching bug caused the model to discard its reasoning history every turn for over a week. A system prompt capped responses at 25 words between tool calls.

The really damning part came from outside Anthropic. Stella Laurenzo, Senior Director of AI at AMD, analyzed 6,852 Claude Code sessions and published her findings on GitHub. Median visible thinking collapsed 73% from January to March. Files read before editing dropped from 6.6 to 2.0. Her conclusion was blunt: "Claude has regressed to the point it cannot be trusted to perform complex engineering."

Anthropic's head of growth also revealed they'd been A/B testing removing Claude Code from the $20 Pro plan on 2% of new signups during this same period. Users who complained about degraded performance for weeks were told they were imagining things. They weren't.

The Georgia Tech data that should be on every CTO's desk.

Georgia Tech's Vibe Security Radar project has been tracking CVEs directly attributable to AI-generated code by tracing commit metadata signatures. The numbers are climbing fast. 18 confirmed AI CVEs in the last 7 months of 2025. Then 6 in January 2026. Then 15 in February. Then 35 in March alone. 74 total confirmed cases, 14 rated critical, 25 rated high. Command injection, authentication bypass, server-side request forgery.

The researchers estimate the real count is 5 to 10 times higher because most AI-generated code lacks detectable metadata. Claude Code accounts for the largest share of confirmed cases at 27, partly because it leaves commit signatures that make attribution possible. Separate analysis by Escape.tech scanned 1,400 vibe-coded apps and found 2,038 highly critical vulnerabilities, 400 plus leaked secrets, and 175 instances of exposed PII including medical records and financial data.

GitHub Copilot started injecting ads into pull requests.

On March 30 a developer in Australia noticed Copilot had edited their colleague's PR description to include a promo for another Microsoft product. A search turned up over 11,400 identical insertions across thousands of public repos. Total estimates put it at roughly 1.5 million affected pull requests. GitHub's VP initially called them "coding agent tips" and later admitted the behavior "became icky." Microsoft's official statement called it a "programming logic issue."

A programming logic issue. Your IDE silently edits your PR descriptions to promote a different product and the company that owns both brands calls it a logic bug.

What the productivity data actually shows.

The METR randomized controlled trial tested 16 experienced open-source developers across 246 real tasks. Developers using AI coding tools were 19 percent slower than those coding without them. But they predicted they'd be 24 percent faster and after completing the tasks they still believed AI had made them 20 percent faster. That's a 39 point gap between what people feel and what the stopwatch shows.

METR tried to repeat the study in early 2026 and couldn't. Developers now refuse to participate in productivity research if they can't use AI. The tools have become psychologically indispensable even when they're objectively slowing people down.

At enterprise scale the picture gets worse. DORA's analysis of 39,000 plus professionals found every 25 percent increase in AI adoption correlates with 7.2 percent less delivery stability. Faros AI tracked 10,000 developers across 1,255 teams and found companies write more code but see zero improvement in delivery velocity. Lightrun surveyed 200 SRE and DevOps leaders and found 43 percent of AI-generated code changes need manual debugging in production after passing QA. Zero percent of organizations said they're very confident AI-generated code will behave correctly in production. Zero.

What this all adds up to.

I started this file because I wanted to know whether I was being paranoid or whether the AI coding marketing had genuinely detached from reality. After a weekend of reading incident reports, postmortems, CVE databases, and randomized controlled trials I think the answer is pretty clear.

The tools are capable of remarkable things. I use them. They help me ship faster on straightforward tasks and I'm not going back to typing every line of boilerplate by hand. But the industry narrative that "AI makes developers 10x faster" is in active conflict with every piece of independently collected data I could find. The same tools that speed up the easy parts are introducing vulnerabilities at scale, eroding delivery stability, and creating a trust deficit that the companies building them seem determined to make worse rather than better.

Amazon can't trust its own AI coding tool on 335 of its systems. Anthropic silently degraded its flagship product for six weeks and got caught by a rival executive with forensic data. Claude Code alone accounts for over a third of all confirmed AI-generated CVEs. Copilot started injecting ads into developer workflows and the official response was "logic issue." Developers are 19 percent slower with AI tools but would rather quit research studies than work without them.

I don't know what the fix is. The economics are too good and the tools are too embedded for any of this to reverse. But the gap between what we're being sold and what the data shows is getting wider every month and at some point pretending otherwise stops being optimism and starts being negligence.

I don't know why I'm still surprised by this.

April 23 Anthropic published a postmortem. Three internal product changes had been silently degrading Claude Code's output for six weeks. The postmortem went up days after the final fix shipped. Not during.

After.

I was one of those people on Reddit in March asking if Claude felt dumber. Got told I was imagining things. Regression to the mean. You're tired. The model hasn't changed. Half the threads got the same four replies from the same four accounts saying the same thing.

It had changed. The vibes were data. We just didn't have proof.

Here's the part that actually bothers me though. Not the gaslighting from random redditors. Not even the bugs themselves. It's that I spent probably 15 hours across those weeks rewriting my prompts. Tweaking system instructions, adding more examples, stripping context to "keep it simple." I was optimizing against a broken target and had no way to know.

And I'd do it again tomorrow. Because when an AI tool gets worse there is no dashboard for "the model is dumber today." No diff. No observability. Your PRs just start taking longer and you assume you're the variable. You always assume you're the variable.

I've been using AI coding tools daily for about a year. Claude Code, Copilot, whatever's cheapest that month. And I've internalized something uncomfortable: these things break without telling anyone, and our entire workflow assumes they won't.

A friend runs a small dev team. They've been vibe coding their customer dashboard for six months. AI generates features, someone eyeballs the diff for 30 seconds, ships. He asked me to look at their codebase two weeks ago because stuff kept breaking in ways nobody on the team understood. I found three npm dependencies that don't exist. Not deprecated. Not abandoned. Don't. Exist. The AI hallucinated them and they'd been importing from nothing for weeks because the fallback paths worked just barely enough to not trigger alerts.

He's a good engineer. But when the AI is right 90% of the time you stop checking. When it silently degrades to 80% you have no signal. The code just gets a little worse each sprint and nobody notices until fire.

The postmortem is good. Companies owning bugs is what we want. But it exposed something that goes way beyond one vendor: we are building actual production software on tools that can break without telling anyone. Our quality processes assume stability. These tools are not stable. They probably never will be in the way we need them to be.

I don't have a clean solution. I still use Claude every day. The economics are stupid good and I'm not going back to typing every line. But I started keeping a dumb little markdown file where I note when the AI feels off. "Today Claude kept suggesting solutions I'd already told it to drop." "For some reason extremely good at SQL this afternoon." It's not data. It's barely even signal. But it's better than gaslighting myself for six weeks again I guess.

Anyway. Using it differently now. We'll see if it holds.

I was the most junior person there by a lot. Spent my first three months breaking the staging environment in ways that seemed impossible. Had a rubber duck on my desk that someone left behind and I talked to it more than I talked to my manager in those first few weeks. Apparently that's how I learned what a race condition actually feels like when you're the one who caused it.

The article talks about talent pipelines. Which is a fancy way of saying nobody knows where seniors come from if you delete the bottom rung. I guess they just appear fully formed with ten years of scars. That's not how it worked for anyone I know.

My first real code review was thirty comments long. I read it on the subway home and missed my stop. Sat at the wrong end of the line for twenty minutes rereading the same comment about variable naming. I wanted to quit that day. I remember staring at my phone and the screen was too bright and some guy was eating a sandwich next to me that smelled like old tuna and I just kept scrolling. Two years later I was writing reviews for the next person who replaced me. That cycle only works if the entry point exists.

Now I see job postings asking for "AI-assisted senior productivity" on roles that used to be junior. The kind of work where you used to shadow someone for six months before they let you touch production. Some of those shadows don't exist anymore. The tools got good enough that management decided the learning part was optional overhead.

I'm not saying we should stop using the tools.

I'm saying if the first rung of the ladder turns into a button, eventually there's no ladder.

And yeah, I still have that rubber duck.

That Google number is the first AI coding stat that actually made me stare at the wall for a minute.

75% of new code being AI-generated and engineer-approved is not the same thing as "engineers are gone". I know that. But it does change the shape of the ladder, and I think people keep waving that away because the alternative is awkward.

The old beginner path was basically: get tickets, write somewhat bad code, get reviewed, slowly build taste by being corrected. Some of the code was clumsy. Some naming was embarrassing. You shipped a tiny bug, someone pointed at it, and the next time you noticed the pattern a little sooner.

If the first pass is now produced by an agent and the human job is to steer, review, and merge, where exactly does the bad first pass happen? In private? In side projects? In interviews? Apparently we are going to tell juniors to review AI output before they have enough scars to know what a bad abstraction smells like.

I had Google's Cloud Next post open in another tab next to some half-finished notes about an interview loop, and the annoying thought was: maybe AI doesn't remove entry-level work directly. It makes entry-level work look like mid-level judgment from day one.

That is a much nastier problem than "learn prompt engineering".

Because if companies start measuring new engineers by how well they supervise generated code, then the thing they need most is the thing the job used to teach them.