A timezone bug on Arthur cost me an hour this summer — not because of the AI, but because I'd stopped keeping my own notes up to date. Three personal experiences and several recent studies point to the same thing: what you choose to keep understanding yourself, when working with AI, matters more than the tool itself.
The UTC bug on Arthur
Summer 2026. On Arthur, my personal assistant, a time was displayed incorrectly: stored in UTC — the reference time zone used by most computer systems — it was read back as if it were local time, several hours off as a result. An ordinary bug, in itself.
What made the fix drag on didn't come from there. During that period, I had stopped keeping my own project tracking files up to date — the notes that tell the AI where development stands, what decisions have been made, what's left to do. The context I was feeding the AI had become inconsistent with the actual state of the code. The AI, receiving contradictory information, ended up doubting what I was telling it, and the fix turned into a loop: several exchanges, about an hour lost.
It's not the AI that got it wrong. It's me who had let my tracking discipline slip on a point that didn't interest me that day — and the AI had no way to help me properly with information that I myself was feeding it incorrectly.
What this reveals
This moment points to a broader question than "should you use AI." The real question is: what do you choose to keep understanding yourself, rather than delegating entirely?
This isn't unique to my case. A study by Microsoft and Carnegie Mellon University, reported in May 2026, of 319 knowledge workers and 936 real-world examples of AI use, shows that greater trust in AI is associated with less cognitive effort spent evaluating what it produces: only 36% of participants reported applying critical judgment to the responses they received.
In France, a 2026 overview published by Cyberini points the same way: AI use is growing faster than AI literacy. Half of French people say they use it, but only a minority actually know how to use it well, and three-quarters of working adults have received no training on the subject.
The risk at a larger scale
This same slippage, at a larger scale, has a name: "vibe coding" — a practice where you have an AI write most of the code by describing what you want in plain language, without trying to understand or verify what gets produced. The risk isn't theoretical.
A research note from the Cloud Security Alliance, published in May 2026 and citing a Veracode study, measures that 45% of AI-generated code samples introduce recognized OWASP Top 10 vulnerabilities — the standard reference for the most common web application security risks. That rate has stayed stable since 2025, despite model providers' announcements about improving their tools.
A concrete case illustrates this: in January 2026, security researchers at Wiz discovered that the production database of an AI-powered social network — Moltbook — had been publicly exposed for three days, with 1.5 million authentication tokens and 35,000 email addresses accessible. The project's founder had stated he hadn't written a single line of code himself. The cause: a misconfigured deployment, never checked by anyone who understood its implications.
The counter-example that works
The opposite also exists, and I experienced it directly. In April 2026, Client Tracker Lite — my first agent connected to a real database, without the tracking tools I use today — often produced wrong results. I didn't just ask the AI to fix it again and again: I went and found out for myself, through my own research, why those errors were happening.
That hard-won understanding was useful later, on Arthur — a more advanced project than Client Tracker Lite. Rather than keeping it to myself informally, I used the AI to put it into shape: an eleven-page document that names the recurring error patterns, defines precise vocabulary to talk about them, and ranks their causes. The AI didn't invent anything in that document — it structured an understanding I already had, gained through experience. That's a difference that matters: using AI to organize what you already know isn't the same as asking it to know in your place.
The limit that remains
One limit remains that neither discipline nor vigilance fully removes: they catch it after the fact, they don't prevent it. On Rooted, an e-commerce site I built as an exercise, the suggested configuration for connecting the database was no longer correct — a setting whose method had changed between versions of the tool in use, and which the model suggested the old, outdated way.
I caught it because I knew what the expected configuration should look like. Without that prior knowledge, nothing in the AI's answer would have flagged the problem: it's phrased with the same confidence whether it's current or not. That's the limit that remains, whatever you do: AI can offer outdated information with complete confidence, and only understanding you already have lets you notice it.
What still needs watching
The UTC bug, vibe coding, Client Tracker Lite, Rooted: four different situations, one single throughline. AI as a tool for emancipation requires continuing to understand what you delegate to it — otherwise it makes you dependent rather than competent.
It's not the AI you need to watch, it's your own rigor: it only fills the gaps you leave it.