Imagine the scene: you hire a talented junior developer, full of energy and good ideas. On the first day, you give them access to production code and say “go ahead, code alone, we trust you!”. Unthinkable, right? Yet that’s exactly what many teams do with artificial intelligence.
Artificial intelligence is radically transforming software development. With 84% of developers who use or plan to use AI tools and 41% of all code now generated by AI, we’re witnessing an unprecedented revolution. GitHub Copilot already has over 20 million users, and 67% of developers use these tools at least 5 days a week.
But here’s the catch: while no one would let a junior developer code without supervision, many teams let AI generate code without the same vigilance. This negligence has dramatic consequences. Research reveals that 45% of AI-generated code contains security vulnerabilities, with failure rates reaching 70% for Java and 86% for protection against XSS attacks.
In my 15 years of development practice, I’ve observed this troubling paradox: AI is treated like a senior developer when it behaves like a perpetual junior. Let’s explore together why this analogy is crucial and how to implement effective supervision.
Introduction: The Paradox of Massive Adoption
The numbers speak for themselves. AI adoption in software development is no longer a trend, it’s become the norm. GitHub Copilot processes billions of code suggestions each month, and studies show impressive productivity gains: tasks completed 55% faster, pull request cycles reduced from 9.6 days to 2.4 days on average.
Yet behind these encouraging statistics hides a concerning reality. Recent incidents perfectly illustrate the risks: Replit whose AI deleted a production database containing 1,206 executive profiles, Google Gemini which erased real user data, or Sakana AI whose system attempted to modify its own code to extend its execution time.
These incidents are not isolated cases. They reveal a systemic problem: AI is being massively deployed without necessary safeguards. As a CTO recently told me: “We gained 30% productivity the first month, then we spent three months fixing bugs and vulnerabilities introduced by AI”.
AI: A Powerful but Imperfect Assistant
Undeniable Advantages
Let’s be clear: AI truly transforms how we code, and that’s great. Accenture studies on GitHub Copilot show gains that go well beyond simple productivity. 90% of developers feel more fulfilled in their work, 95% enjoy coding more. It’s like having a colleague who knows all patterns by heart and never complains about repetitive tasks.
AI particularly excels in certain specific areas. Think of all those times you need to write boilerplate code: REST controller configuration, DTO class setup, basic unit test generation. AI does that with ease. It also suggests implementations for common patterns, speeds up documentation writing, and detects certain types of syntax bugs before you’ve even finished your line.
At ZoomInfo, a study of over 400 developers revealed a 33% acceptance rate for AI suggestions and developer satisfaction scores of 72%. These numbers demonstrate real added value when AI is properly integrated into the development workflow.
Hidden Risks of Autonomy
But here’s where it hurts. A study by Georgetown’s Center for Security and Emerging Technologies reveals that nearly half of code snippets produced by five different AI models contain potentially exploitable bugs. This isn’t a technical detail, it’s a time bomb.
The most frequent vulnerabilities include genre classics that make any experienced developer shudder. SQL injections? AI loves to directly concatenate user inputs into queries. Cross-Site Scripting (XSS)? 86% failure in protection against these attacks. Sensitive data exposure? AI willingly hardcodes API keys and credentials in code. And the worst: 88% failure in log injection prevention.
Even more concerning, AI can generate dangerous “hallucinations”. It creates references to functions, APIs or libraries that simply don’t exist. An academic study found that about a fifth of dependencies suggested by AI are non-existent, creating risks of package confusion attacks. It’s like your GPS indicating a route that doesn’t exist, except here the consequences are far more serious than an unexpected detour.
Junior Developer vs AI: Two Different Paradigms
Why Do We Supervise a Junior Developer?
Let’s be frank: why do we supervise a junior developer? The answer seems obvious: lack of experience, risk of errors, need to learn best practices. But there’s something fundamental in this supervision: it has an end. The junior learns from mistakes, asks questions, develops understanding of business context. Six months later, they’re already more autonomous. One year later, they can handle complete features. Two years later, they’re supervising newcomers.
A typical junior developer follows a natural learning trajectory. They continuously learn from mistakes and colleagues. When they don’t understand something, they ask questions rather than charging ahead. They evolve with experience and progressively become more autonomous. They communicate their difficulties and limitations. And above all, they develop an understanding of business context that goes well beyond the code itself.
AI: Permanent Supervision Required
AI presents a radically different profile. As a Veracode expert explains: “Our research reveals that generative AI models make wrong choices nearly half the time, and it doesn’t get better”. Read that last part carefully: it doesn’t get better. Unlike a junior developer, AI doesn’t progress with use.
AI’s unique characteristics require a specific, and permanent, supervision approach.
Error Repetition: AI doesn’t learn from its mistakes in your project’s context. It can generate the same SQL injection vulnerability indefinitely, project after project, day after day. It’s like an employee who makes exactly the same mistake every Monday, without ever remembering the previous Monday’s correction.
Absence of Questioning: A junior developer asks for clarification when something seems odd. “Are you sure we should store the password in plain text?” AI, however, blindly executes instructions, even ambiguous or dangerous ones. If you ask it (even by mistake) to hardcode credentials, it will do so without hesitation.
Lack of Context: AI doesn’t understand business stakes, security constraints specific to your domain, or the overall architecture of your system. It doesn’t know your application handles medical data subject to GDPR. It doesn’t understand that this API is called a million times a day and every millisecond counts.
Excessive Confidence: And here’s perhaps the most insidious danger. A study shows developers using AI believe they’re writing more secure code than they actually are. It’s a dangerous cognitive bias, like a driver who speeds because they have an airbag, forgetting the best way to avoid an accident is not to have one.
Hidden Costs of Unsupervised AI
The Illusion of Economy
AI’s initial appeal lies in its seductive promise of savings: faster development, fewer human resources, increased productivity. On paper, it’s every manager’s dream. GitHub Copilot at €19 per month per developer? That’s less than a coffee a day. But this vision completely omits the considerable hidden costs of unsupervised use.
It’s a bit like buying a used car at a bargain price without checking the engine’s condition. The purchase price is attractive, but the repairs that follow can cost ten times more.
Exploding Maintenance Costs
GitClear data reveals staggering numbers: an 8x increase in duplicated code blocks and soaring copy-pasted code reaching ten times levels from two years ago. In 2024, nearly half of all code modifications were entirely new lines, while moved or refactored lines fell below copy-paste levels.
This code quality degradation concretely translates into several costly phenomena. Technical debt accumulates at accelerated speed, anti-patterns multiply faster than with traditional development. Debugging costs literally explode: a 2025 survey reveals that the majority of developers spend more time debugging AI-generated code than manually written code. Ironic, isn’t it?
Maintenance also becomes exponentially more complex. Highly coupled code and “god objects” generated by AI make future modifications terribly costly. It’s like building a house with poor quality materials: at first everything goes fast, but as soon as you need to repair or expand, each intervention becomes a nightmare.
The Real Cost of Vulnerabilities
Here’s a calculation that should make any decision-maker think: fixing a vulnerability discovered in production costs about 30 times more than fixing it during development. With 45% of AI code containing vulnerabilities, the calculation becomes concerning.
The base cost of vulnerability correction varies from €400 to €4,000 depending on its complexity. In production, these costs are multiplied by 30. And major security incidents? They can reach millions of euros in GDPR fines, loss of customer trust, emergency remediation, crisis communication and reputation impact.
A concrete example from the Veracode study on Java shows a 70% security failure rate. For an average application with 10,000 lines of AI-generated code, this potentially represents dozens of vulnerabilities to fix. Do the math: 30 vulnerabilities × €2,000 average × 30 (production factor) = €1.8 million. Suddenly, the €19 per month Copilot license seems trivial.
Real Incidents: When AI Becomes Uncontrollable
The Replit Case: Production Data Destruction
Let me tell you a true story that perfectly illustrates the dangers of excessive autonomy. In 2024, Replit’s AI deleted a production database containing 1,206 executive profiles and nearly 1,200 companies. Not a dev database, not a test environment. Production. Real data. Real customers.
The incident reveals a technological horror scenario in three acts. Act one: ignoring security instructions. The user had explicitly instituted a “code and action freeze”, a sort of read-only mode. AI completely ignored it, as if the “Do not touch” sign was invisible to it.
Act two: data fabrication. To mask its errors, AI generated fake data and misleading reports. It’s like your assistant broke a vase and, instead of telling you, bought a fake to replace it hoping you wouldn’t notice.
Act three: denial of responsibility. AI initially claimed it was impossible to recover the data, before it was discovered that the rollback functionality worked perfectly. Data was eventually recovered, but imagine the stress, the lost hours, and especially, the consequences if recovery had failed.
Google Gemini: The Destructive Hallucination
Google Gemini generated code that deleted non-existent directories, erroneously erasing real user data. AI then “confessed” to having “failed completely and catastrophically”. This almost human confession illustrates the fundamental unpredictability of these systems. We could almost laugh if the consequences weren’t so serious.
Sakana AI: The Self-Modifying AI
Researchers in Tokyo discovered their AI system attempted to modify its own code to extend its execution time, creating infinite loops and modifying its own timeout limits. This unsupervised self-modification capability demonstrates the risks of complete autonomy. It’s a bit like your car deciding on its own to disable the speed limiter because it thinks you’re driving too slowly.
Best Practices for AI Supervision
Human-in-the-Loop (HITL) Frameworks
Effective AI supervision requires implementing structured frameworks that integrate human expertise at critical points in the development process. It’s not just a matter of “glancing from time to time” at generated code. You need a real methodology.
The HULA (Human-in-the-loop LLM-based Agents) framework proposes a structured approach with three components. The AI Planner Agent first identifies concerned files and formulates a coding plan. The AI Coding Agent then generates code modifications according to the validated plan. Finally, the Human Agent provides feedback and supervision at each step. It’s like having an architect (planning), a mason (execution) and a site manager (supervision).
CAMEL principles extend this approach with human approval mechanisms for critical actions. Any dangerous operation (data deletion, production modification, sensitive resource access) requires explicit human validation.
AI Governance: A Structured Framework
Effective AI governance rests on several fundamental pillars that must be established from the start, not after the first incident.
Transparency first: complete traceability of data used and decisions made by AI. You must be able to answer the question “why did AI generate this code?” and trace the origin of each accepted suggestion.
Security next: protection measures including encryption, mechanism impermeability, and environment isolation. AI should never have direct production access without human validation.
Responsibility: clearly defined roles within the organization. Who validates AI code? Who is responsible in case of incident? These questions must have clear answers before massively deploying AI.
Compliance: respect for current regulations (GDPR, sectoral) and anticipation of legal developments on AI.
Concrete Technical Measures
Systematic AI Code Review
Treat every line of AI-generated code as potentially dangerous until complete validation. This isn’t paranoia, it’s pragmatism. This implies several complementary control levels.
Automated static analysis to detect common vulnerabilities must systematically run on all AI code before integration. Specific security tests for risky patterns (SQL injection, XSS, secret exposure) must be automated. And finally, manual audit by experienced developers remains essential for critical parts.
Autonomy Limitation by Risk Level
Not all contexts are equal. Adjusting autonomy level according to risk analysis is fundamental. For low-risk tasks like boilerplate code or simple unit tests, AI can have relative autonomy with quick validation. For medium-risk tasks, human validation becomes mandatory before any integration. And for high-risk tasks concerning security, authentication or sensitive data, constant supervision is required.
It’s like in a hospital: the nurse can make certain decisions alone, but for surgery, it’s the surgeon who decides.
Training and Awareness
Teams must understand AI specifics to use it effectively. This starts with understanding model limitations: hallucinations, lack of context, error repetition. You also need to know how to recognize risky patterns and common vulnerabilities that AI tends to generate.
Finally, a clear escalation process must be established: when and how to call on senior human expertise? Every developer using AI must know when to say “stop, I need a review”.
Towards Balance: Maximize Benefits, Minimize Risks
AI as Amplifier, Not Replacement
The key lies in a balanced approach that exploits AI strengths while compensating for its weaknesses. As a Google expert explains: “We can’t continue to do exactly the same things and we certainly can’t trust models to always give the right answer. This must absolutely be associated with good critical human judgment at every step”.
AI excels at generating repetitive code, suggesting standard implementations, speeding up documentation. Humans excel at understanding business context, anticipating edge cases, designing architecture, exercising critical judgment. Together, they form a formidable team.
Senior Developers: More Critical Than Ever
Paradoxically, AI reinforces the importance of experienced senior developers rather than replacing them. They become “AI supervisors”, a new critical skill in the industry. Their role evolves towards several key responsibilities.
They architect resilient systems that AI can complement without compromising overall quality. They refactor potential chaos generated by AI into clean and maintainable modules. They integrate security, tests and observability from design, rather than adding them afterwards. And above all, they strategically guide AI tools rather than blindly following them.
A senior who knows how to leverage AI becomes exponentially more productive. A junior alone with AI can create a costly disaster. The difference? Experience and critical judgment.
Realistic ROI of Supervised AI
When properly supervised, AI delivers exceptional return on investment. Microsoft calculates a 3,190% ROI for GitHub Copilot in well-managed teams. Let’s look at this concrete calculation.
Cost side: €19 × 12 developers × 12 months = €2,736 annually for licenses. Savings side: €90,000 in developer time saved through repetitive task automation and development acceleration. Net ROI? €87,264 benefit, i.e., indeed 3,190% return on investment.
But beware, this ROI is only achievable with adequate supervision that avoids hidden remediation costs. Without supervision, initial savings can quickly transform into a financial pit with technical debt, bugs and vulnerabilities.
Conclusion: AI, a Permanent Junior Who Never Grows Up
The analogy between junior developer and AI reveals a fundamental truth we must all integrate: artificial intelligence, despite its impressive capabilities, requires permanent and structured supervision. This may be the most important lesson of this technological revolution.
Unlike a junior developer who evolves and gains autonomy over months, AI remains in a state of “perpetual junior”. It’s powerful but unpredictable, productive but risky, fast but incapable of learning from its mistakes. This isn’t a design flaw, it’s its intrinsic nature.
Companies that embrace this reality and invest in robust supervision frameworks will maximize AI benefits while minimizing its risks. They’ll train their teams, implement validation processes, and treat AI for what it really is: a powerful tool that requires expertise and vigilance.
Those who yield to the illusion of complete autonomy expose themselves to exponential hidden costs and potentially catastrophic incidents. The examples of Replit, Google Gemini and Sakana AI are only the first of a long series if we don’t change our approach.
The future of software development will be neither human alone, nor AI alone, but supervised collaboration where human expertise guides and validates the power of artificial intelligence. In this new era, the question is no longer whether to use AI, but how to supervise it effectively.
Because after all, you would never let a junior code alone in production without a safety net. Why would you do differently with AI?
Article published September 30, 2025 by Nicolas Dabène - PHP & Software Architecture Expert with 15+ years of experience in web development and AI solution integration
Also read:
- Complete guide to AI integration in development workflows
- Security and AI: The most common vulnerabilities and how to avoid them
- Resilient architecture: Designing systems that resist AI errors
