A No Priors speaker says early AI writes verbose code, so human design judgment matters

A speaker on the No Priors podcast argued that safer software starts with smaller software. Early AI tools tend to write long, complex code, which works against that. For now, the speaker said, human judgment still matters in designing software that stands on its own securely. The point came in an October 23, 2026 episode on security for the agentic web, meaning the web as used by AI agents.

What was said

The speaker started from first principles. Attack surface means the places an attacker might get in. The easiest fix is to offer fewer of them: review all your software and ask how to simplify it and cut the code. Tools like formal verification (mathematical proof that code behaves as intended) come after that. AI complicates this. The speaker said that "the early AI is very verbose. It likes to create complexity." In their view, AI has so far not helped build more secure software, though they think it will get there. In their words, this is "where humans still come in", to design software that can stand securely. A speaker on the show noted that simplicity is not the natural inclination of today's models. The fix, they said, has to work at every level. Product engineers need training, and security teams still give a second pair of eyes. Cloudflare keeps an internal document called the Codex, built from team design proposals. It is boiled down to commandments that agents apply during reviews. People run the security and performance checks deeper in the process.

Why it matters

Our reading: buying AI coding tools does not by itself shrink risk. The speaker's logic is that fewer places for vulnerabilities means less to defend. Verbose code does the opposite. It gives reviewers more lines to read and more places for a flaw to hide. When code is cheap to produce, simplifying it becomes the scarce work. Two questions for a leader follow. Who owns the call on whether a piece of code should exist? And what written principles is AI output checked against? Cloudflare wrote its principles down so reviewers, human and machine, can check against them. Teams without them have less to measure AI output against.

The other side

The speaker did not say AI will stay verbose. They think it will get there. The Codex hands part of the judging to agents, so the line between human and machine judgment is blurry. No figures were given on how much code shrinks or how many flaws that prevents. The conversation also left open how to train people to judge well.