AI-written code: an instruction is not a guardrail

On 26 January 2026, Andrej Karpathy, a co-founder of OpenAI and former head of AI at Tesla, posted on X his notes after several weeks of programming with Claude. Between November and December 2025, he went from about 80% of code written by hand, autocomplete included, to 80% written by agents. He also listed their flaws: unchecked assumptions, needlessly complicated code, changes outside the task. The next day, a developer, Jiayuan Zhang, turned these observations into an instruction file for the Claude Code agent and published it on GitHub (international · GitHub). As of 29 October 2026, the repository has more than 226,000 stars, GitHub’s equivalent of a bookmark.

Its success shows a strong demand: to discipline the AI that writes code. Yet Karpathy wrote it himself: these flaws persisted despite a few simple instructions in the CLAUDE.md file, which the agent reads before it starts work. An instruction is a request made to the model; a guardrail is a control that does not depend on it.

What the repository actually contains

• An author who is not Karpathy (international · GitHub): the “andrej-karpathy-skills” repository was created on 27 January 2026 by Jiayuan Zhang (account forrestchang) and now sits under the multica-ai organisation. It describes itself as inspired by Karpathy; nothing indicates that he contributed to it.
• A single file: a CLAUDE.md of about 65 lines, also packaged as a plugin for Claude Code and as a rule for the Cursor editor.
• Four principles: think before coding, stating assumptions; simplicity first, adding nothing that was not asked for; surgical changes, with every changed line traceable to the request; goal-driven execution against verifiable criteria, writing the test first and then making it pass.
• Massive reach: 226,259 stars and 22,598 forks as of 29 October 2026, according to GitHub.
• What it does not contain: no rules on security, secrets, dependencies, licences or traceability. The file openly favours caution over speed.

What Karpathy wrote in 2026

• 26 January (international · X): agents’ mistakes are no longer syntax errors but conceptual ones, the kind a slightly hasty junior developer makes. For code that matters, he advises watching them “like a hawk”. He also notes that his own ability to write code by hand is starting to atrophy.
• 4 February (international · X): he proposes the term “agentic engineering” for programming through agents under human oversight, with one aim: to gain leverage from agents without any compromise on software quality.
• 25 February (international · X): in his view, coding agents have genuinely worked since December 2025, but they need direction, judgement and oversight. They do best on well-specified tasks that can be checked by tests.

The real issue: control must keep pace with speed

On 28 July 2026, the security vendor Veracode (United States · Veracode) published its annual report on AI-generated code. Without security guidance, the models tested fail in nearly 44% of tasks where security matters, while their code is almost always syntactically correct. The average pass rate, 56%, has barely moved in a year. These tests cover models on their own, without tools or review: the code works, but that does not make it safe.

As early as 2024, the French and German cybersecurity agencies (France · ANSSI and Germany · BSI) set out the principle: coding assistants are no substitute for experienced developers, and developers’ productivity gains must be matched by stronger quality assurance and security teams. If agents write faster, review has to grow at the same pace; otherwise risk builds up in the repository.

Three points to watch

1. An instruction is not enforced. A CLAUDE.md file is read by the model, not applied by a machine. The rules that matter must live in the integration pipeline: mandatory tests, code analysis, protected branches, no merge without review.

2. Invented dependencies. Models sometimes suggest libraries that do not exist. A 2024 study cited by ANSSI and BSI found 19.7% of 2.23 million generated imports were hallucinated. An attacker can publish a malicious package under that name: a software supply chain attack.

3. Ownership of the code. On 2 March 2026, the Supreme Court (United States · Supreme Court) declined to hear the Thaler case, leaving in place the requirement of a human author for copyright. The Copyright Office (United States · Copyright Office) had already stated in January 2025 that prompts alone do not make the user the author of the output. Code written mostly by an agent may therefore be hard to protect: the human contribution needs to be documented.

What an organisation should require from its teams and contractors

1. Named human review: no change produced by an agent is merged without an experienced reviewer who can explain it.
2. Success criteria written before the code: tests first, and continuous integration that blocks the merge if a test fails.
3. Traceable usage: tool, model and version declared for every delivery, instruction files versioned in the repository, agent-produced changes identifiable.
4. Automated security checks: static analysis, secret detection, an allowlist of dependencies, an inventory of software components.
5. Secrets out of reach: no production credentials given to an agent, isolated environments, least privilege. In February, Karpathy gave an agent the credentials of a personal machine; in a company, this is exactly what a secrets policy must govern.
6. Clauses in service contracts: disclosure of the AI tools used and the data entrusted to them, assignment of rights in the delivered code, a non-infringement warranty, liability for security flaws.
7. Sized review capacity: track the volume of merged code and the security teams’ workload, as ANSSI and BSI recommend.

An agent follows instructions; only an organisation enforces controls.

The question to ask on Monday morning

To your CIO and your contractors: “What share of the code delivered this quarter was written by an agent, and who reviewed it?”