u/Natural-Economist136

Marcus died on a Tuesday. Heart attack at 43, at his desk, which is the kind of thing that makes everyone in the office buy standing desks for a week and then slowly forget about it. By the following Monday the standing desks were all back down and people were eating lunch at their keyboards again like nothing had happened.

We had a small memorial in the conference room. Someone brought supermarket flowers. His manager said some words about dedication and institutional knowledge. HR sent a company-wide email with a subject line that read "Celebrating the Life of Marcus Webb" and contained exactly four sentences.

IT deactivated his credentials that Friday. I know because I was CC'd on the email. Standard procedure, they said. Access terminated, accounts archived, nothing unusual.

I'm a systems administrator. Checking logs is literally my job. I do it every morning before I touch my coffee. Network traffic, login attempts, database queries, anything that looks out of place. Three weeks after Marcus died, I was running through the overnight activity when I saw his username pull a report from our HR database at 2:14 AM.

Not a scheduled report. A manual query.

I stared at the screen for a long time. Then I checked the credentials table. His account showed as deactivated. Disabled. No active sessions, no valid token, nothing that should have allowed access.

I flagged it to my manager. She said it was probably a ghost process, some automated task that hadn't been cleaned up properly when IT archived the account. She said she'd look into it. That made sense to me. I let it go.

Then it happened again the following week. Different report. Different time. But the same username. Marcus Webb. Deactivated. Somehow pulling files at 1:47 AM on a Thursday.

I pulled the full access history going back to the date of his death. His credentials had been used eleven times. Always between 1 and 3 AM. Always manual queries. Always pulling the same small cluster of personnel files.

My file was in that cluster.

I escalated to IT security. Two of them spent most of a day on it. They found nothing. No breach, no active session, no sign of anyone using stolen credentials from outside the network. The logs showed the access clearly. Timestamps, query strings, everything. But the access, technically, had not happened. Their words.

I asked what that meant. The senior guy shrugged and said logs sometimes contain artifacts. Ghosts in the system. He said it with the confidence of someone who had run out of other explanations.

Last Thursday I stayed late to finish a project deadline. Our floor empties out by seven. By nine I was the only one left, just me and the hum of the servers and the lights that stay on motion sensors and keep clicking off in the far corners whenever I'm not moving.

At 2:14 AM my monitor flickered.

A report opened on my screen. I hadn't touched the keyboard. I hadn't touched the mouse.

The report was a single page. Marcus's personnel file. Employment dates, salary history, benefits elections, all the ordinary administrative residue of a working life. At the bottom, termination reason: cardiac event.

I read it twice before I noticed the notes field.

The notes field had been empty the last time I checked his file. I know because I had looked at it during the IT security investigation, looking for anything unusual.

It wasn't empty anymore.

Someone had typed four words.

Tell them it wasn't.

I closed my laptop. I gathered my things. I walked to the elevator and rode it down seventeen floors and pushed through the lobby doors into the cold air outside and stood on the sidewalk for a while not entirely sure what I was doing.

I haven't been back to the office since. I've been calling in sick, which isn't something I do. My manager has called twice. I haven't answered.

I keep thinking about what the notes field said. I keep thinking about the eleven access events. I keep thinking about why that particular cluster of personnel files, and whose names are in it besides mine.

I looked up Marcus's obituary last night. It said he is survived by his wife and two daughters. It said he loved fishing and coaching his daughter's soccer team. It said he passed unexpectedly.

It did not say anything about what he had been working on before he died.

I'm going to need to go back eventually. I know that. But before I do I want to know if anyone else has seen something like this, and I want to know if you think I should pull those other personnel files and find out whose names are in there with mine.

Because whatever is using his login clearly wants someone to know something.

I just don't know if I want to be the one who finds out what it is.

Marcus died on a Tuesday. Heart attack at 43, at his desk, which is the kind of thing that makes everyone in the office buy standing desks for a week and then forget about it.

IT deactivated his credentials that Friday. I know because I was CC'd on the email.

Which is why I don't understand the activity logs.

I'm a systems administrator. Checking logs is literally my job. Three weeks after Marcus died, I saw his username pull a report from our HR database at 2:14 AM. Not a scheduled report. A manual query.

I flagged it to my manager. She said it was probably a ghost process, some automated task that hadn't been cleaned up properly. That made sense. I let it go.

Then it happened again. Different report. Different time. But the same username.

I pulled the full access history. Marcus's credentials had been used eleven times since his death. Always between 1 and 3 AM. Always pulling personnel files. Always the same small group of employees.

My file was in that group.

I escalated to IT security. They investigated and found nothing. No breach. No active session. The logs showed the access but the access, technically, had not happened.

Last Thursday I stayed late to finish a deadline. I was the only one on the floor. At 2:14 AM my monitor flickered and a report opened on my screen.

I hadn't touched anything.

The report was a single page. Marcus's personnel file. Termination reason listed as: cardiac event.

At the bottom of the page, in the notes field, something had been typed.

The notes field had been empty the last time I checked his file.

It said: Tell them it wasn't.

I haven't been back to the office since.

Something weird has happened on my team over the last year

before AI tools got this good everyone more or less had to understand the codebase enough to survive on their own

maybe not perfectly
maybe not elegantly
but you still had to reason through things yourself

now I’m noticing a massive gap between engineers who use AI as acceleration and engineers who use it as replacement thinking

the difference becomes painfully obvious during debugging

one group treats AI output like a starting point
they still question assumptions
trace issues manually
understand tradeoffs
notice when generated code does not actually fit the system

the other group pastes stack traces into Claude and fully commits emotionally to whatever comes back first

I watched someone confidently approve a PR recently because “the AI explanation made sense”

the PR literally introduced a race condition

and the scary part is the person is not stupid at all

I genuinely think the convenience is slowly removing the mental friction that forced people to deeply understand systems before

because now you can remain productive for surprisingly long periods without fully understanding why something works

until production catches fire

then suddenly the people who actually understand architecture debugging state management and system behavior become insanely valuable again

I don’t think AI is replacing engineers nearly as much as it is exposing who was relying on surface-level understanding the whole time

which honestly might end up being more uncomfortable for the industry than automation itself