You Hit Accept; You Own the Bug

AI-generated code does not transfer accountability to the model that wrote it.

The hook

Three Tuesdays ago, eleven minutes of 502s. A data-fetching function held a database connection open inside a loop, the connection pool drained under concurrent load, and PagerDuty fired. In the retro, the engineer who shipped it said something I have now heard three times this year: "The AI wrote that part. I did not catch it."

क्षमेची तू मूर्ती · You Are the Form of Forgiveness

क्षमेची तू मूर्ती । पाप पुण्य तुझे हाती ॥
मज सोडव दातारा । कर्मापासून दुस्तरा ॥
तुका म्हणे नारायणा ॥
Every action accumulates consequence; the person doing the action cannot later disclaim the result.

What I keep seeing

The function had been generated by Claude inside Cursor. It worked in dev. It passed the existing test suite. The reviewer glanced at it, saw it looked clean, and approved. Standard workflow, standard disaster. The code was so plausible that it lowered everyone's guard.

I have been wrong about this, by the way. Two years ago I thought AI code review would get easier as models got better. It got harder. The better the model, the more polished the output, the less your brain flags it for scrutiny. GitHub's own Copilot research showed acceptance rates were highest for boilerplate, exactly the code most likely to contain subtle resource-management bugs.

Anthropic, OpenAI, Google: none of them are on your PagerDuty rotation. Their terms of service explicitly disclaim liability for generated output. Everyone knows this. Nobody acts like they know it.

The mechanics

When an LLM generates code, it predicts the next token over a distribution learned from public repositories and documentation. It has no model of your connection pool size, your request concurrency, or your timeout configuration. It generates the happy path from a tutorial. That path compiles, runs, and fails under conditions the model never saw, because those conditions live in your infrastructure, not in the training corpus.

The failure modes are specific. Resource cleanup that works single-threaded but leaks under concurrency. Error handling that catches a generic exception and swallows it. SQL queries correct for small datasets that do full table scans at production scale. These are not hallucinations. The code is real. It just encodes assumptions about an environment it has never met.

Code review was supposed to catch this. But code review evolved when the bottleneck was writing, not reading. Human-written code leaves reasoning traces: variable names reflecting mental models, comments at tricky spots, commit messages explaining approach. AI-generated code arrives fully formed and syntactically clean. There is less signal about intent. Reviewing it is like proofreading a paragraph in a language you almost speak.

Where Tuka comes in

Tukaram addresses God as the embodiment of forgiveness (क्षमेची तू मूर्ती), then immediately states that sin and merit are in your hands (पाप पुण्य तुझे हाती). This is not a plea for mercy. It is an accounting statement. Consequences accumulate regardless of who you delegated the work to. You can ask for release from karma's difficulty, but the karma was generated by your actions.

The LLM is the generous provider (दातारा), offering code freely. But पाप पुण्य तुझे हाती: the bug and the feature are both in your hands. The engineer clicked accept. The model performed generation. Only one of them has a production environment, a customer base, and an SLA.

What I would actually do

Require a simple inline comment on any function generated or substantially modified by an AI tool: // ai-assisted. Not for shame. For traceability. That tag becomes the code-review speed bump: slow down, check edge cases, verify resource handling. Add a pre-merge CI step with Semgrep or CodeQL rules targeting the patterns LLMs get wrong most often: unclosed resources, generic exception swallowing, N+1 queries, missing pagination. Update your incident retro template with one new field: "Was AI-generated code involved, and where did review miss it?" The model is a tool. The engineer is the author. Accountability follows the hands on the keyboard, not the weights in the network.

Chetan Dhandal