The foundation: engage.re
Verification 30 July 2026 9 min read

AI Writes Code Fast. Amazon Shows What Happens Without Verification.

Amazon had four top-severity outages in one week in March 2026, and it added review rather than banning AI coding tools. Veracode measured a 56% security pass rate across more than 100 models. The question for a buyer is not whether AI wrote the code. It is whether anybody verified it, and whether you can check the answer. This article gives six questions and the evidence behind each one.

Connect with us about verified software · · Replies within 24 hours

56%
security pass rate across more than 100 models
4
top-severity Amazon outages in one week, March 2026
v2.0.0
the published conformance package a third party can test against

Is the concern about AI-written code justified?

Yes, and the evidence is specific. Veracode tested code generated by more than 100 models and published LLMs Are Getting Smarter, But Not Safer. The security pass rate was 56%.

The report's title carries the important finding. Capability improved across model generations, and security did not improve with it.

Generated code therefore works and contains defects at a measurable rate. Both statements hold at the same time.

What did Amazon do?

Amazon experienced four top-severity outages in one week in March 2026. CNBC reported that the company planned an internal review of AI-related outages.

Amazon did not ban the tools. It added review steps around them.

That response is the useful signal. A company with world-class engineering capacity concluded that the tools stay and the verification changes. The problem was the process around the code, not the origin of the code.

The false choice

Buyers are usually offered two positions. Use AI tools and accept the risk, or refuse them and accept the cost.

Neither position describes what decides an outcome. Human-written code contains defects, and it always has. Generated code contains defects at a different rate.

One property separates safe software from unsafe software, and it is the same property in both cases. Somebody checked it, against a stated expectation, and can show the result.

Two kinds of change, one danger

A change to software fails in two ways, and they differ in how they are found.

Failure How it appears How it is found
It stops workingAn error, a crash, a blank screen.Immediately, by a user.
It works incorrectlyA plausible wrong result.Months later, or never.

The second failure is the expensive one. A calculation that returns a wrong figure produces a valid-looking number, and a person acts on it.

Generated code raises the second risk more than the first, because a model produces code that runs. Running is the easy property.

What does verification actually mean?

Four practices, and each one produces evidence you can inspect.

  1. A stated expectation. Somebody wrote down what the software must do, before it was built.
  2. An automated check per expectation. A test that fails when the behaviour changes.
  3. A human review of the change. A named person read it and accepted it.
  4. A record after release. The behaviour is monitored, so a regression is detectable.

The National Cyber Security Centre's secure development and deployment guidance sets out the wider practice.

Practice one does most of the work. A test can only check an expectation that somebody stated, so undocumented behaviour cannot be verified by anybody.

What ESRE Media offers

We build your system on engage.re, and three properties make verification possible rather than aspirational.

  • Your expectations are declared. Your application declares every record type, field and relationship before it writes anything, and the server refuses a write outside that declaration. The expectation is machine-checkable rather than written in a document.
  • The platform behaviour is published. A conformance package at engage.re/conformance, at version 2.0.0, states the behaviour a conforming implementation must show. A third party can test against it.
  • Every change leaves a record. Each access is an event in a signed chain, so a wrong result can be traced to the records that produced it.

We name the person accountable for your system, in your contract. Sense Future built engage.re, and it has run in production since December 2025.

Six questions to ask a supplier

Each one has a factual answer, and each answer can be checked.

  1. Who is accountable for this system, by name? An organisation name is not an answer.
  2. Where are the expectations written down? Ask to see them.
  3. How many automated checks run before a release? Ask for the number and the last run.
  4. Who reviews a change? A person, not a process diagram.
  5. How do you detect a wrong result after release? The answer separates monitoring from hope.
  6. Can a third party test your platform behaviour? A published specification makes this possible.

Question five is the one most suppliers answer poorly, and it addresses the failure that costs most.

Age is not verification

An established product has one advantage. Its defects have had time to appear, and many have been fixed.

Age does not supply the four practices. A twenty-year-old system may hold no stated expectations, few automated checks and no monitoring for wrong results. Its defects are simply older.

The correct comparison is therefore not new against old. It is verified against unverified, and both a new system and an old one can sit on either side.

The same question at two sizes

A council procures a system that calculates entitlements. A wrong calculation produces a plausible figure, an officer acts on it, and a resident receives the wrong amount. The council needs to know how the supplier detects that class of failure, and a certificate does not answer it.

A care home group buys a system that calculates staffing ratios. The same failure mode, at a smaller scale, with a regulator asking the same question.

The care home software and construction software pages set out the sector detail. Our guides to bespoke software and care regulations and who answers when AI gets it wrong cover the accountability that follows.

What we do not claim

  • Verification does not remove defects. It reduces them, and it makes the remaining ones findable.
  • We use AI tools in our own work. The four practices above are the reason that is a reasonable position.
  • The Veracode figure describes generated code in a test setting. Treat it as evidence of a rate, and not as a prediction about one project.

What to do next

  1. Send the six questions to your current supplier this week.
  2. Ask to see the written expectations for one feature you depend on.
  3. Ask how a wrong result would be detected, and who would notice.
  4. Find one wrong figure your organisation acted on in the last year, and ask how it was found.
  5. Then judge suppliers on verification rather than on the age of the product.

Common questions

Is AI-written code safe to use in business software?

It is as safe as the verification around it. Veracode tested code from more than 100 models and measured a 56% security pass rate, and capability improved across model generations while security did not. Generated code works and contains defects at a measurable rate, so the process around it decides the outcome.

What happened at Amazon in March 2026?

Amazon experienced four top-severity outages in one week, and CNBC reported that it planned an internal review of AI-related outages. Amazon did not ban the tools, and it added review steps around them. A company with world-class engineering capacity concluded that the process needed changing, not the tooling.

What is the real risk with generated code?

Code that works incorrectly rather than code that stops working. A crash is found immediately by a user. A calculation that returns a plausible wrong figure is found months later, or never, and somebody acts on the number in the meantime.

What does verification consist of?

Four practices. A stated expectation, written down before the software was built. An automated check per expectation, which fails when the behaviour changes. A human review of each change, by a named person. A record after release, so a regression is detectable. The first does most of the work, because a test can only check an expectation somebody stated.

Is an older software product safer?

Not by itself. Age means its defects have had time to appear, and many have been fixed. A twenty-year-old system may hold no stated expectations, few automated checks and no monitoring for wrong results. The comparison that matters is verified against unverified.

What does ESRE Media build?

We build your system on engage.re. Your expectations are declared and the server enforces them, the platform behaviour is published in a conformance package at version 2.0.0 that a third party can test against, and every access is an event in a signed chain. We name the accountable person in your contract.

Connect with us about verified software · · Replies within 24 hours

Sources and further reading