Mitchell Hashimoto's whiteboard defense for AI code
He does not care who typed the code, only whether you can defend the system in a hallway conversation.
Mitchell Hashimoto posted his bar for responsible AI usage, and it is a conversation, not a diff. He calls it the whiteboard defense. He should be able to pull you aside at any moment and ask you to explain any customer-facing system you have shipped, and you should be able to say why you did X instead of Y, what happens if an actor behaves maliciously, what data structure you used, and where it fails.
But if you're shipping customer-facing work, you can't be shipping things you don't understand at a high level.
What he explicitly does not want is line-level familiarity. You may not remember the function name. You may not know it at all. For proofs of concept, demos and experiments he says generate 100% of it and understand none of it, speed over quality every time.
The thread he landed in
Days earlier, Boris Cherny published his reply to a reader asking about AI code quality. The line that traveled, quoted by Simon Willison, was that production code written by Claude should have a higher bar than if it was written by a human.
Production code written by Claude should have a higher bar than if it was written by a human
Matteo Collina pushed back at Cherny directly, arguing the standard is easier to hold inside Anthropic than outside it, since Anthropic blocks its best models from doing security review. His question was blunt about which models everyone else is supposed to use for that.
If I can’t use the best models Anthropic offers to do security reviews, which models should I use?
Addy Osmani turned the same argument into a checklist. Agree on the outcome and the constraints first, give the agent the exact build, test and lint commands so it can check its own work, and when it misses, write the lesson into CLAUDE.md rather than quietly fixing it by hand. His organizing idea is blast radius. Throwaway code with a small blast radius can be a black box, production code touching money, auth or user data cannot.
Where it splits
Not everyone accepts the premise. Theo said most human code he has encountered is much worse than AI generated code from Fable and Astra. Thorsten Ball went after the metric itself, wondering when people will stop judging model output by how hard it will be for a human to understand or modify.
For working engineers, this is the old code ownership argument with the line moved. Nobody in the thread is asking who typed it. They are arguing about which artifacts you have to be able to defend when somebody asks, and Hashimoto's answer is the ones your customers touch.