Claude opened 30+ pull requests for us in one afternoon. One of them deleted a p

By Neerajdask · October 31, 2026 · Curated by George's Blog

Claude opened 30+ pull requests for us in one afternoon.

One of them deleted a permission check and put nothing in its place.

- It looked clean.

- It passed CI.

- It was formatted perfectly.

If we had merged it, a customer could have seen contract data they were never meant to see.

I blocked it.

Here's what I learned about working with AI at scale:

1. AI is great at the mechanical 30%. It replaces the old call with the new call. It cannot tell you why the old check existed.

2. "Green CI" is not the same as "safe." Tests prove what you thought to test. They don't prove what the AI quietly removed.

3. The real work is the part nobody ticketed. When I compared the plan against what the AI had actually touched, 7 gaps had no owner at all.

4. Big PRs hide risk. We stopped shipping one giant change and moved to one flow at a time, each tested with real user roles before it merged.

5. Ask "who owns this?" in public. Several of those PRs touched other teams' code. One question in the right channel saved us a lot of pain.

The result: 33 tickets, shipped piece by piece, with no broken customer access.

AI doesn't remove the need for senior engineers.

It raises the price of not having one in the room.

What's the most dangerous thing an AI has ever almost shipped for you? #SoftwareEngineering #AI #CodeReview #EngineeringLeadership