AI coding speed without validation is debt
- YT :: https://www.youtube.com/watch?v=aWVtmZ30oxM
- Original title :: The "10x AI Developer" Trap Nobody Talks About
AI coding agents make you feel fast before they make you feel responsible: watching an agent create files, wire up config, and pass a few tests looks like progress, but "it runs" is not the same claim as "it's production ready." The bottleneck in software was never typing - it's trust: can this code be reviewed, can this dependency ship, did the agent violate a policy or pull an unsafe package to solve the happy path.
Sponsored by Endor Labs, the video demos their AURI security-scanning tool (MCP/CLI/editor integrations) against two projects: a clean real prototype (boring, clean scan - the sanity check that the tool doesn't manufacture drama) and a project seeded with intentional problems, closer to what fast AI-generated code produces. The seeded project's scan surfaces a high-severity command injection, two medium reachable vulnerabilities (prototype pollution, a regex denial-of-service), and a low-severity but verified-inactive leaked token - the emphasis being on reachability (does this vulnerability actually matter in this codebase) over generic dependency alerts that are easy to ignore.
The broader argument: AI makes mistakes faster, neater, and easier to miss, producing a clean-looking diff over a messy supply chain. If security checks happen only after the PR, once the team has mentally accepted the work is done, no time was saved - it was borrowed from the security review. The career move isn't refusing AI or blindly shipping whatever it produces; it's building a workflow where security checks sit as close to the editor and the moment of generation as possible, so a senior developer can say not just "the agent built it" but "I checked what it introduced."