AI-written code always has bugs nobody has found yet. Here is how I use it anyway. AI 写的代码总有没找到的 bug，我照样大量用它，靠的是闸门

Why the bugs never run out

I fix the bugs I know about. The ones I don’t know about, I have no way of knowing. So I will never finish fixing bugs, and neither will AI: each review just finds a different unfinished batch. That means safety can’t depend on anyone’s vigilance, mine or a model’s.

Sort mistakes by what they cost

Instead of trying to find every bug, list what can go wrong when software runs a machine, from mild to severe:

• Something on screen looks wrong: annoying, harmless.
• The machine won’t move.
• The machine damages itself.
• A person gets hurt.
• A catastrophic loss.

There are only a handful of these classes, and they don’t grow as the code grows. That makes them something you can actually check.

Gates, like a type system

For each dangerous class, build a hard check that every command must pass before it reaches the machine. If you have never used a typed language such as Java, Go or Rust: its compiler refuses to run a program when a value is the wrong kind, the way a socket won’t take the wrong plug, however careful the programmer was that day. A gate works the same way. If the preconditions for a command aren’t met, the command doesn’t go through.

The software will be wrong someday. The gates’ job is to make sure being wrong can’t turn into harm.

Where AI fits

Once the gates sit in a layer that neither I nor the model can write or bypass, AI’s speed becomes safe to use. I use it heavily, on the non-core parts, after I have made the decisions. The division of labor is explicit: AI generates, I decide, the gates enforce. Safety no longer depends on how careful anyone happened to be on a given Tuesday.

The same idea works away from machines. An AI agent that can move money should only propose, while an authorization layer it can’t touch does the executing: Governing AI agents that touch money. An assistant that holds private data should have exactly one way out, and that way out should be checked: A private AI assistant and its outbound boundary.

Written from my work on the operator interface for a force-controlled industrial robot (a client integration project, not the robot maker’s own software), with all client, vendor and product details removed. And in keeping with the subject: AI helped me write this page. The thinking is mine.

Related: the full method behind the consequence classes, Industrial reliability: count consequences, not bugs (on boheastill.com). The wider argument: Where value goes when building is free.