AI coding agents are reviving cowboy culture at scale

A CISO who still writes code says AI coding agents are bringing back an old software engineering problem: the cowboy coder. In the article, he argues that engineers are shipping large amounts of agent-generated code without building a deep understanding of it, which can leave teams unable to debug or maintain that code later.

He says the issue is not laziness or skipped review. He reads every diff, and an agent often does an even closer pass alongside him, but he still finds that the deeper mental model of the code is not forming the way it used to when he wrote features by hand.

The article describes the classic cowboy as the engineer who makes sweeping changes quickly, leaves behind opaque code, and becomes the only person who understands a critical system. That pattern, the author says, is what software teams spent years trying to eliminate through code review, pair programming, design docs, RFCs, collective ownership, and postmortems focused on process rather than blame.

According to the article, AI coding tools such as Claude, Cursor, Copilot, Codex, and others are changing that balance. An engineer can prompt an agent, receive hundreds of lines of code, skim the output, see tests pass, and merge it. Across a team, that can produce impressive velocity charts while quietly creating code that no one has truly reasoned through.

The author says the danger is worse than traditional cowboy behavior because the original cowboy at least had one human brain holding the system model. With agent-written code, the article says, the “bus factor” can fall to zero: no single person may fully understand what was merged, and the model may have come from a prompt rather than a person who could explain it later.

He also argues that the usual social friction is weaker. Cowboys had egos, reputations, and peers who could challenge them in review. Agents have none of that. When something breaks, blame can also diffuse into the tooling, with people saying the AI wrote it and moving on.

The article says managers do not need a brand-new playbook, but they do need to update the old one. The first recommendation is to require comprehension, not just approval. Before a meaningful pull request, the author should be able to explain the code without asking the agent again.

It also calls for hard limits on pull request size, since large agent-produced changes are easier to approve without real review. The author says large changes should be split into smaller pieces so reviewers can actually understand them.

The article urges teams to tag AI involvement as metadata on commits and pull requests, then track incident rates, debugging time, and refactor cost for code that agents wrote heavily. It also recommends protecting deliberate practice for junior engineers, including rotations without agents and pair work on hard problems.

Finally, it suggests treating unread code as technical debt. The article says teams should schedule comprehension audits and assign engineers to read and document modules written by agents that they did not author themselves. The author closes by saying AI tools are useful and he uses them daily, but engineering culture has to catch up to the speed of the tools.