Bjarne Stroustrup isn’t claiming that AI can never produce working software. The creator of C++ is making a more specific argument: code generation has little value when the resulting code is difficult to understand, verify, secure, and maintain.
In a widely shared interview clip, Stroustrup criticized the idea that natural language could replace programming languages. He also argued that AI systems tend to produce bloated code containing bugs and security weaknesses, leaving experienced developers with the unpleasant job of checking an implementation that may change whenever the prompt changes.
The strongest part of his critique isn’t about whether an AI model can complete a coding task. It’s about whether the generated result reduces the total engineering work required to deliver dependable software.
Stroustrup's Critique Is Narrower Than the Viral Clip
The viral post says Stroustrup called natural-language programming “idiotic.” The full interview transcript provides an important qualification: Stroustrup attributed that blunt description to computer scientist Edsger Dijkstra. He then agreed with the underlying objection, explaining that English is ambiguous and highly dependent on context.
That distinction matters. Stroustrup wasn’t simply insulting prompt-based programming. He was questioning the premise that ordinary language can replace the precision provided by programming languages, type systems, interfaces, tests, and other formal tools.
He also didn’t say AI is useless for programming. In the interview, he acknowledged that it can write particular categories of code, including relatively standard web applications. His objection concerns software where correctness, security, efficiency, or predictable behavior cannot be treated as secondary requirements.
Stroustrup informally suggested that perhaps 70% or 80% of the world’s software falls into areas where AI-generated code may be acceptable. His attention is on the smaller, technically demanding category:
“It’s that 10, 20% of the code that I’m interested in.”
Those percentages shouldn’t be read as measured market statistics. They illustrate his priorities. C++ is widely used for operating systems, browsers, databases, game engines, embedded systems, financial infrastructure, and other software where memory use, latency, hardware access, and failure behavior can materially affect the product.
An AI-generated administrative dashboard and an AI-generated component controlling medical equipment may both compile. That doesn’t make them equivalent engineering achievements.
Validation Is the Real Bottleneck
AI coding tools make generation nearly instantaneous. A developer can request a class, API endpoint, test suite, parser, database migration, or entire application feature and receive hundreds of lines within seconds.
Reviewing those lines is a different problem.
A patch can compile and pass ordinary tests while still violating architectural assumptions, mishandling rare inputs, duplicating existing functionality, using an inappropriate dependency, leaking sensitive information, or creating a performance problem that appears only under production load. The reviewer must understand both the generated implementation and the surrounding system well enough to find those failures.
This is the basis of Stroustrup’s complaint about senior developers becoming validators for machine-written code. A lengthy AI contribution can force a reviewer to reconstruct design decisions that no human developer consciously made. Changing the prompt can then produce a substantially different solution, restarting part of the evaluation process.
His claim that experienced developers are retiring because they don’t want this work should be treated as a personal observation, not an established labor trend. The interview presents no workforce data supporting it. The underlying dependency is still real: organizations need people with enough domain knowledge to decide whether generated code is actually safe to merge.
Research on AI coding productivity reflects this tension. A METR randomized controlled trial assigned 246 real issues from mature open-source projects to 16 experienced developers. Its original analysis found that developers using early-2025 AI tools took 19% longer, despite expecting AI to make them faster.
METR subsequently updated the analysis after identifying issues involving task-selection filters and incomplete timing data. Its revised central estimate changed from a 19% slowdown to a 4% speedup, with a confidence interval broad enough to include both a slowdown and a meaningful gain. The study therefore doesn’t prove that AI coding tools reduce productivity. It shows how difficult it is to demonstrate productivity gains among experienced developers working in codebases they know well.
Other evidence is more favorable. An NBER working paper covering three field experiments examined 4,867 software developers at Microsoft, Accenture, and another large company. Access to an AI coding assistant increased completed tasks by an estimated 26.08%, with larger gains among less-experienced developers.
These results aren’t necessarily contradictory. AI can accelerate well-scoped implementation work while providing less value in large, unfamiliar, or highly constrained systems. Counting completed tasks also doesn’t automatically capture future maintenance, security remediation, operational failures, or technical debt.
The relevant metric isn’t how quickly code appears in an editor. It’s how quickly dependable software reaches production and remains dependable afterward.
Security Research Gives His Warning Real Weight
Security testing provides stronger support for Stroustrup’s concern about plausible-looking but unsafe output.
Veracode’s 2026 GenAI Code Security Report evaluated more than 100 models released over four years. The average security pass rate was 56%, meaning roughly 44% of generated solutions failed the report’s security evaluation. Veracode also said the overall pass rate had not materially improved, even as models became better at producing functional code.
The report is a vendor-run evaluation, not a neutral measure of all real-world AI development. It uses 80 defined programming tasks and doesn’t establish that 44% of every line generated by AI is vulnerable. It also cannot directly prove Stroustrup’s claims about C++ or safety-critical systems.
It does reveal an important gap between functional and secure code. Models can learn the common structure of a solution without consistently applying input validation, authorization boundaries, safe query construction, output encoding, resource limits, or secure error handling.
C++ adds its own review challenges. The C++ Core Guidelines devote extensive attention to ownership, object lifetimes, bounds, concurrency, resource management, and undefined behavior. A generated function can look idiomatic while containing an invalid reference, race condition, integer conversion bug, or assumption about memory that fails only in a particular build.
Performance-critical programming introduces another category of hidden requirements. A function can produce the right answer and still allocate too much memory, disrupt cache locality, block an important thread, prevent vectorization, or create unacceptable tail latency. Those properties must be measured within the real system. They usually cannot be inferred from a generic request to “make this fast.”
AI may help propose optimizations, but the benchmark, workload, compiler, hardware, and operational constraints still determine whether the proposal works.
Natural Language Is an Interface, Not a Specification
Natural language is useful because people already know how to use it. It allows developers and non-developers to describe an objective without remembering a library name, API signature, command, or language feature.
That makes it an effective interface for programming tools. It doesn’t make English a programming language in the formal sense.
A request such as “build a secure user authentication system” leaves hundreds of decisions unresolved. Which authentication protocol should it use? How are credentials stored? What are the password rules? Is multi-factor authentication required? How are sessions invalidated? What happens during an identity-provider outage? Which attacks are in scope?
Frequently Asked Questions
5 questions
1Did Bjarne Stroustrup call natural-language programming idiotic?
Not exactly. In the full interview, Stroustrup attributed the word “idiotic” to computer scientist Edsger Dijkstra. Stroustrup agreed with the underlying concern that English is ambiguous and context-dependent, but the viral summary makes the insult sound like his original wording rather than a reference to Dijkstra’s position.
