Hot take: sloppy AI code is a checking problem, not a model problem

Every week someone posts a screenshot of AI-written code doing something dumb, and the conclusion is always the same: the model is bad. Two things published this week point somewhere else.

1. Anthropic ported its Messages API to Rust, with Claude writing the code. On Latent Space's Oct 27 episode, Anthropic's Claude Platform leads Katelyn Lesse (engineering) and Angela Jiang (product) described the project. The Messages API, the service behind Claude API calls, was a "very CPU inefficient" Python monolith. The team chose Rust even though, in the guest's words, "we don't have a single Rust developer in the room," and "Claude is going to write the code. The humans design the system." It was fully rolled out "as of last week."

2. The part that made it shippable was the check, not the code. "The two things that mattered most were the plan to do the thing and then the verification of the thing." The team built a full Rust fork of the API, ran shadow traffic through it, and verified that the Python and Rust systems returned the same outputs before switching real traffic over. It was a pure port: no new features slipped in, and static analysis flagged any new Python feature that hadn't been carried over to Rust.

3. The result, as a ballpark. Asked for numbers, the guest said "somewhere like 40 to 50 percent" CPU savings and "somewhere between like 10 and 20 percent" faster time to first token. That is a podcast estimate, not a published benchmark, and there was no breakdown by workload.

4. Same week, a reminder of what unchecked AI code looks like. Veracode's Fall 2026 update (Oct 29) tested 18 models across Python, C#, JavaScript and Java on four vulnerability types. The average security pass rate rose from 56% to 62%, which still means roughly 4 in 10 tasks produced code with a known vulnerability when the model got no security-specific guidance. The best scores were 73% (Claude Opus 5.5 and GPT-6-Sol). Most of the gain came from cross-site scripting; log injection stayed around 12%, and Java scored about 31%.

What the viral version gets wrong. Posts are calling it "zero Rust devs." The team started with none, but Anthropic also said it "hired a couple of people who have more experience with Rust" along the way. Some posts add a "90k lines" figure; nothing like that was said in the episode. And the transcript does not label speakers, so we attribute the quotes to the two guests rather than to one person.

The catch. Anthropic is describing its own product and its own team, with no published numbers. Veracode sells code scanning, and its own conclusion is that a mid-tier model plus scanning beats a frontier model with no verification. Both have a stake in the answer. Neither is a test we ran.

Our take. "Sloppy AI code" is mostly code nobody proved. Anthropic didn't make the port safe by reading every line; it made the new system prove it matched the old one on real traffic. Most teams shipping AI code have no equivalent: no shadow traffic, no output diff, often no tests that encode what the code is supposed to do. If you can't show the new code does what the old code did, you aren't shipping AI code. You're shipping a guess. Before you blame the model, write the check.

MODEL Editors