Rich Hickey is right, and your AI assistant belongs in the dependency audit

I expected to disagree with Rich Hickey. “It’s just a tool” is the phrase I reach for when a relative asks whether AI will take their job. Hickey’s essay, published on 12 October, opens like a dictionary fight, with paragraphs on the verb “wield” and on the pockets of his shirts. Then he gets to the drive-thru, and I think he wins, though for a reason he only half states.

His case is that a tool is held, controlled and gives you feedback while you use it. An LLM takes a request and goes off and acts, so he files it under automation. What interests me is what follows from that for anyone shipping software. Engineers already have a category for a component they can’t inspect, can’t predict, can’t pin to a version and don’t own. We call it a dependency, and we have decades of habits for treating dependencies with suspicion: lockfiles, changelogs, licence reviews, vendored copies, somebody whose job includes reading the release notes. Almost none of that gets applied to the model generating code inside the editor.

Hickey’s sharpest line on this is that you are “only a software update from everything you’ve ‘learned’ being rendered obsolete”. That describes an unpinned transitive dependency. Your prompt files, your team’s habits of phrasing, the voodoo.md he mocks, all of it is coupled to behaviour a vendor can change without a version bump or a deprecation notice. If a library behaved like that, someone would open a ticket to replace it.

The practical problem with calling it a tool is that we judge tools by feel, and developers’ feel about AI has been measured and found wanting. In METR’s early-2025 trial, 16 experienced open-source developers expected a 24% speed-up. Their tasks took 19% longer with AI. Afterwards they believed they had been 20% faster. Andrew Wegner points out that under every condition METR has tested, developers’ estimates of their own speedup have sat above what was measured. Meanwhile Stack Overflow’s 2025 survey, with over 49,000 responses, found 84% using or planning to use AI tools, up from 76% the year before, while the share distrusting the output rose from 31% to 46%. Experienced developers were the most wary: 2.6% highly trust it, 20% highly distrust it. Usage climbing while trust falls is how people usually describe the package they can’t get rid of.

The obvious reply is that the models have improved, and METR itself said in February 2026 that developers are likely more sped up now than in early 2025. Its 10 returning developers showed an estimated 18% cut in task time. I accept that the tools may now be faster. But the interval on that estimate runs from -38% to +9%, and METR calls the data unreliable. The reason it gave is the most interesting finding in the whole programme: a significant increase in developers declining to take part because they do not wish to work without AI. The study’s control arm is collapsing because people refuse to remove the thing being tested. In any other part of the stack, a component you cannot switch off for a fortnight gets a risk owner and a fallback plan.

None of this makes AI assistance bad. Your database driver is a dependency, and you’d be mad to write your own. Once the model is on the dependency list, the team has to record its version and write down what happens on the day the vendor changes or withdraws it. It also answers the people who say the skill is in using it well. Skill at a dependency is mostly knowledge of its quirks, and as Hickey says, the next update can wipe that out. Two-thirds of the Stack Overflow respondents said AI answers were almost right but not quite, which is the failure mode of a component whose behaviour you can’t see inside.

So do to the model what you’d do to any library you depend on. Record the model name and version in a commit trailer on every AI-assisted change, add a “model changed” field to your incident tracker, and for one week each month leave the assistant off for a random half of tickets and time them from the tracker rather than from anyone’s memory. If your team won’t agree to the week off, as METR’s volunteers wouldn’t, enter that refusal in the risk register as a single-vendor dependency with no fallback, and give it an owner before the next quarterly review.

Prompted by 'AI' is Not a Tool by Rich Hickey, Gist.