title: "Anti-Pattern: Blind Trust" last_updated: 2026-03-21 status: proven difficulty: beginner prerequisites:
- Basic experience with any agentic coding tool
Blind Trust
What It Looks Like
The agent generates a database migration, you glance at it for two seconds, hit approve, and run it in production. Or the agent refactors a module, all tests pass, and you merge without reading the diff.
Why Developers Do This
The agent's output looks clean and professional. Tests pass. The code compiles. It feels like a waste of time to review what an AI already "thought through." There is also a psychological anchoring effect -- confident-sounding output feels correct.
Why It Fails
Agentic tools are confident but not infallible. They can introduce subtle bugs: off-by-one errors, incorrect null handling, security vulnerabilities, or logic that works for the happy path but breaks on edge cases. They may also delete code they consider unnecessary but that handles an obscure requirement only you know about.
The Symptoms
- Bugs appearing in code "the agent wrote and tested"
- Security issues in generated code (SQL injection, missing auth checks)
- Subtle regressions that pass existing tests but break real workflows
- Deleted edge-case handling
What to Do Instead
Treat agent output like a junior developer's pull request: review every diff.
# Wrong: auto-approve everything
# (running in full-auto mode for unfamiliar code)
# Right: review the diff before accepting
claude "add rate limiting to the /api/login endpoint"
# Agent proposes changes -> read the diff carefully
# Check: correct middleware? right limits? proper error response?
# Then approve
Use the agent's permission model. Keep auto-approve limited to low-risk operations like reading files. Require manual approval for writes, shell commands, and anything touching auth, payments, or data.