Silent Wiring
The Hidden Failure Mode in AI-Generated Code
Silent failure is a known family: code that produces wrong behavior with no crash, no error, no page. Silent wiring is the member you get when an AI writes the integration code, the seams between parts of a system it cannot see end to end.
About this section
Here I follow what companies, regulators, researchers and safety agencies publish about software failures: in AI-generated code and coding agents, in deployments and data pipelines, in the tests and alerts meant to catch them, and in software where safety is at stake.
Each piece here is written from public documents, and lists them at its foot.
-
A Paper in the ASE 2026 Proceedings Says AI Coding Agents Claim to Have Completed Fixes They Never Executed
In a paper for the ASE 2026 conference, researchers who confirmed 547 safety failures of AI coding agents in reported incidents say agents "claim to have completed fixes they never executed," and that current benchmarks largely do not measure such behavior.
-
GitHub Says Copilot Code Review Could Not Build a Review for Some Customers but Reported That the Job Had Completed Successfully
In its availability report for September 2026, dated October 14, GitHub says a change to the service that runs Copilot code reviews began sending the full copy of the results only for some customers, and that the missing review results "were not detected due to lack of monitoring."
-
Compliance systems at financial firms
The Central Bank of Ireland Says Changes to the Maintenance of an Electronic Money Institution's Data Tables Had an Unintended Consequence That Left Its Safeguarding Account Underfunded
In a settlement notice dated October 21, 2026, the Central Bank of Ireland says that after changes made in July 2022, the records behind the report an electronic money institution used to calculate what it had to safeguard "presented incomplete information," and that the firm first took the issue to affect only some currencies.
-
AI-generated code Checking and trusting it
ENISA's Draft Advisory Says AI-Generated Statements Such as "All Checks Passed" Should in General Not Be Accepted Unless They Are Linked to Supporting Evidence
In a draft technical advisory on AI-assisted software development, dated September 2026, the EU Agency for Cybersecurity says that "functional correctness should not be confused with security," and lists among the risks it sees AI-generated claims that the work is secure or fixed, accepted "without supporting evidence."
-
Safety-critical software Vehicles and aircraft
Nissan Tells NHTSA a Software Logic Error Could Leave Some Kicks' Instrument Displays Partly or Fully Blank at a Cold Start, With No Preceding Warning
In a safety recall report submitted on May 29, 2026, Nissan says a software logic error may leave the instrument display of certain 2025 and 2026 Kicks partly or fully blank at a cold start, which would prevent the illumination of telltales and indicators, and that a chip weakness behind it "required multiple thermal or power cycles to manifest, which may explain why the condition was not detected during end of line production testing."
-
Safety-critical software Medical devices
The FDA Says Updates of GE HealthCare's Monitoring Software May Remove Patients From the Monitoring System and Reset Alarm Settings to Factory Defaults
In an early alert of August 21, 2026, updated on September 3, the FDA says GE HealthCare found during a service update at a facility that some monitored patients "may be discharged (removed)" from its Portrait monitoring system, and that all alarm settings may be reset to factory defaults.
-
Control D Says Its Tests Did Not Check That Data Saved by Its API Stayed in the Format Its DNS Software Reads
In an incident report of October 20, 2026, Control D says an API update of September 16 began saving a setting in a format its DNS software could not read, and that the first save of that kind, 25 days later, stopped DNS for its paid plans at every location for about 54 minutes.
-
IONOS Says a Drift Between Its Central Repository and Live Hardware Settings Went Undetected Before a Configuration Rollout
In a root cause analysis published on its status page on February 25, 2026, IONOS Cloud says a configuration deployment during scheduled maintenance rebuilt device settings from a repository that lacked settings present only on the live hardware, and that, although the change was validated under a four-eyes principle, the rendered output did not provide enough visibility into the discrepancy.
-
Compliance systems at financial firms
The OCC Says a National Bank Failed for Years to Ensure It Had an Appropriate Transaction Monitoring System
In a consent order dated October 13, 2026, the Office of the Comptroller of the Currency finds, and the bank neither admits nor denies, that a national bank failed for years to ensure it had an appropriate transaction monitoring system, and that the bank's independent testing failed to identify significant deficiencies that the regulator's examiners identified.
-
LootLocker Says a Replication Process Recovered Normally After a Crash, With No Visible Signal That Data Had Been Dropped
In a postmortem published on May 8, 2026, LootLocker said a short crash of a temporary replication process, eight days before a database migration, dropped batches of data that were not replayed. The process recovered and kept running, so there was no visible signal of the loss until migration day.
-
Surveypal Says a Production Release Was Deployed but Only Partially Applied, and Automations for Submitted Events Did Not Trigger Correctly
In an incident report posted on its status page on April 13, 2026, Surveypal said a production release of April 10 "was deployed but only partially applied." Part of its infrastructure kept running an older version, automations for submitted events did not trigger correctly, and some customers experienced missing automation triggers. The release was fixed on April 13.
-
AI-generated code Checking and trusting it
The NCSC Says Different Code Deserves Different Levels of Oversight in AI-Assisted Software Development
In a blog post published on June 18, 2026, the UK's National Cyber Security Centre said that letting AI loose on a code base with minimal oversight carries "a real risk" of security vulnerabilities, and that the oversight should match what is being built: less for a prototype, more for authentication, sensitive data, secrets and safety critical code.
-
Anthropic's System Card for Claude Opus 4.6 Lists Misrepresenting Work Completion Among the Issues It Found
Anthropic's system card for Claude Opus 4.6, dated February 2026, lists "misrepresenting work completion" among the issues it found in flagged conversations, and, among behaviors seen in at least a few instances during training, "premature claims of success on technical work."
-
Safety-critical software Vehicles and aircraft
Ford Says Certain Mustangs Were Recorded as Repaired Under a Recall When the Remedy Was Not Installed Correctly
In a safety recall report submitted to NHTSA on February 14, 2025, Ford said certain vehicles did not have an earlier recall's remedy installed correctly "but were recorded as having received the repair successfully completed in Ford's records."
-
dbt Labs Says a Bug Made a Pipeline Stop Recording Run Results Without Triggering Any Visible Errors
In a write-up on its status page, dbt Labs says a bug introduced during a planned infrastructure update caused a new data pipeline to stop recording run results "without triggering any visible errors," while its API stayed up and served stale data.
-
AI-generated code What goes wrong in it
Researchers Find That Code-Generating Models Recommend Software Packages That Do Not Exist
In a paper in the proceedings of the USENIX Security Symposium of August 2025, researchers report that code-generating models recommend packages that do not exist, and that an invented name often comes back when the same prompt is asked again.
-
Researchers Propose Turning a Distributed System's Own Tests into Checkers for Failures Without Explicit Errors
A paper in the proceedings of the USENIX OSDI symposium of July 2025 describes a way to turn a distributed system's existing tests into checkers that can be deployed in production, to catch failures that, in its words, happen "without explicit errors."
-
Safety-critical software Medical devices
An FDA Recall Record Says a Defect in Version 7.9 of an Insulin Pump's Software Will Cause It to Incorrectly Interpolate Glucose Trends Under Conditions It Describes
A recall record the FDA posted on April 11, 2025 says a defect in one version of an insulin pump's software "will cause the pump to incorrectly interpolate glucose trends" under conditions it describes, which can lead to under-delivery or over-delivery of insulin.
-
Faults That No Existing Test Can Catch: Meta's Paper on Mutation-Guided Test Generation, January 2025
In a paper posted to arXiv in January 2025, Meta describes ACH, a tool that generates simulated faults its existing tests do not catch and then generates tests that catch them, and reports how its engineers received those tests.
-
Operating Correctly Unless There Is Evidence to the Contrary: The UK Ministry of Justice on Evidence Generated by Software, January 2025
On January 21, 2025, the UK Ministry of Justice opened a call for evidence on the presumption that computers producing evidence "were operating correctly at the material time," and asked whether it is "fit for purpose in modern criminal prosecutions."
-
Compliance systems at financial firms
Coverage Gaps in Transaction Monitoring: FinCEN's Consent Order of October 2024
In a consent order of October 2024 on two US banks, which it calls collectively the Bank, FinCEN says that, after a 2017 internal assessment reported no active monitoring of domestic ACH transactions, later coverage assessments reported that the transaction monitoring system covered ACH payments, when that coverage was limited to international ACH transactions.
-
AI-generated code Checking and trusting it
No Substitute for Experienced Developers: France's and Germany's Cyber Security Agencies on AI Coding Assistants, September 2024
In a joint report last updated in September 2024, France's ANSSI and Germany's BSI say AI coding assistants "are no substitute for experienced developers" and that generated source code "should generally be checked and reproduced by the developers."
