Everyone reading GM’s disclosure that nearly 90% of the code from its autonomous driving team is now AI-generated is reacting to the wrong number. The panic reflex says: machines are writing the software that steers two-ton vehicles through intersections. My reaction is the opposite. That figure is boring. It’s the least interesting thing GM could have told us, and the fact that it became the headline says more about our anxieties than about how safety-critical AI actually gets built.
The number that matters is the one nobody published: how much of GM’s engineering effort now goes into proving that code correct. Because if you’ve ever shipped a bot that touches anything real, you know the generation step was never the bottleneck.
Generation was always the cheap part
I build bots for a living. I write about architecture on this site. And the pattern I keep hitting is the same one GM is hitting at a much larger scale: producing a plausible implementation takes minutes, and convincing yourself it won’t do something stupid at 3 a.m. on an edge case takes weeks.
A bot that drafts email replies can be 95% right and still be useful. A bot that files refunds, moves money, or pushes commits to production cannot. The moment your system takes an irreversible action, the economics invert. Your test rig, your simulation layer, your rollback path, and your audit trail stop being supporting infrastructure and become the actual product. The model is a component. The verification stack is the engineering.
Which is why the TechCrunch Disrupt 2026 session pairing Shield AI CTO Nathan Michael, Waabi founder and CEO Raquel Urtasun, and GM Director of Robotics Strategy Mikell Taylor is more relevant to small-team bot builders than it looks on paper. Defense autonomy, self-driving trucks, and automotive AV programs sound like problems with budgets you and I don’t have. But the discipline they’re describing — safety validation, regulatory navigation, building trust — scales down further than most developers assume.
Three different answers to the same question
What makes this lineup worth watching is that these three organizations don’t share a failure mode.
- Shield AI operates where the environment is actively hostile and the situation is unpredictable by design. You can’t enumerate your test cases when an adversary is choosing them.
- Waabi has bet heavily on simulation as the path to generalization, and the company has real capital behind that bet after securing $1 billion in new funding in January 2026. Its stated frontier is generalization itself — systems that hold up in conditions nobody wrote a test for.
- GM carries the weight of a legacy manufacturer’s compliance obligations, a shipped fleet, and now a codebase where the overwhelming majority of new lines came out of a model.
Same underlying question, three incompatible operating contexts. When practitioners with that much distance between them converge on similar practices, those practices are probably load-bearing rather than cultural.
What this means for your bot on Monday
You’re not certifying a vehicle. You’re probably shipping an agent that hits a few APIs. Here’s what transfers anyway.
Treat generated code as untrusted input
GM’s 90% figure only works because the code lands inside review, testing, and validation machinery built to catch what humans and models both get wrong. Generated code isn’t dangerous because a model wrote it. It’s dangerous when it skips the gate. If your agent writes and executes its own code, the gate is your sandbox and your permission model, and you should be able to describe both in one sentence.
Build the simulator before the feature
Waabi’s approach makes a practical claim: you learn more from replaying thousands of synthetic scenarios than from a handful of live runs. Your version of this is a fixture set — recorded traffic, adversarial prompts, malformed payloads — that runs on every commit. Cheap to build early, near-impossible to retrofit once the bot has users.
Separate reversible from irreversible
Split your action space by consequence. Reading, drafting, and proposing can run freely. Writing, sending, paying, and deleting go behind confirmation or a staged approval. This one architectural line does more for safety than any amount of prompt tuning.
Log for the investigation you haven’t had yet
Regulatory navigation, stripped of formality, means being able to reconstruct a decision after the fact. Inputs, model version, tool calls, outputs. If you can’t replay a bad run, you can’t fix it — you can only guess and redeploy.
The real lesson
The teams shipping AI into situations where failure isn’t recoverable aren’t winning because they found better models. They’re winning because they built the apparatus that makes model output trustworthy enough to act on. That’s an engineering problem, it’s unglamorous, and it’s available to you right now at whatever scale you’re working.
Ninety percent AI-generated code isn’t a warning. It’s a hint about where to spend the other 10% of your time.
🕒 Published: