Earlier this month Claude Code made a commit in our test app with the message "Limit contact name to 250 chars". The tests passed. Our verification hook ran, passed, and stamped the commit. CI was green.

The name limit did not change. The email limit did.

What happened

We were testing a GitHub Action for laravel-ai-verify , a package I maintain that makes coding agents run the checks a change needs before they say "done". The test app is a plain Laravel contact form. The form request had two rules next to each other:

'name' => [ 'required' , 'string' , 'max:200' ], 'email' => [ 'required' , 'email' , 'max:255' ],

Enter fullscreen mode

Exit fullscreen mode

The intent was to limit the name to 250 characters. The agent did what agents often do with a one-line change: a find-and-replace of max:255 with max:250 . There was no max:255 on the name line. There was one on the email line.

Every check we had said yes:

PHP syntax: fine.

The tests for that form request: green.…