AI does not write buggy code. It writes unwired code.
I spent a night auditing my own system. Six adversarial reviewers, then six more whose only job was to refute the first six. Fifty findings. Thirty-four survived execution-level attack.
Almost none of them were bugs in the sense the word usually means.
The code compiled. It passed every gate. It was well structured, and better documented than most code I have read. Comments explained why, not just what. Decisions from three months earlier were reconstructible from the source.
What I found instead was machinery that had been built and never connected.
A gate that exists, runs nowhere. A rule declared, enforced by nothing. A configuration key, signed and ratified, read by no code at all. A test suite that passes under any mutation you make to the thing it tests. A comment asserting that a door refuses something, when no such door was ever built.
Here is the part that took me a while to see. Most codebases lie by omission. There are no docs, so you read the code and you find out. A codebase built quickly with AI lies the other way. The documentation is confident, precise, and everywhere, and some of it describes machinery that was never wired in.
That is more dangerous, not less, because the documentation is good enough to be trusted.
I think the cause is structural rather than careless. AI writes at the speed of intention. It records what should be true faster than anyone can verify what is true. Every one of my findings had the same shape: an intention was written down, and nobody checked whether it landed.
The cure I am adopting is one line.
Every declared thing must have a reader, or an expiry date.
If a constant, a config key, a rule or a gate has nothing that consumes it, the build fails. If it is deliberately switched off, it carries a signed date, and when that date passes the build fails until someone renews it or arms it.
Not a rule against unfinished machinery. A rule against unfinished machinery that is silent about it.
The uncomfortable part is that this only becomes visible when you go looking. Nothing was on fire. Nothing crashed. Every one of these had been quietly not working for weeks, in a system that looked healthy from every dashboard I own.
If you are building with AI right now, that is the question I would ask about your own system this week. Not: is the code correct. Is the code connected.